Issued:
2009-02-06
Updated:
2009-02-06

RHSA-2009:0271 - Security Advisory

Synopsis

Important: gstreamer-plugins-good security update

Type/Severity

Security Advisory: Important

Topic

Updated gstreamer-plugins-good packages that fix several security issues
are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

GStreamer is a streaming media framework, based on graphs of filters which
operate on media data. GStreamer Good Plug-ins is a collection of
well-supported, GStreamer plug-ins of good quality released under the LGPL
license.

Multiple heap buffer overflows and an array indexing error were found in
the GStreamer's QuickTime media file format decoding plugin. An attacker
could create a carefully-crafted QuickTime media .mov file that would cause
an application using GStreamer to crash or, potentially, execute arbitrary
code if played by a victim. (CVE-2009-0386, CVE-2009-0387, CVE-2009-0397)

All users of gstreamer-plugins-good are advised to upgrade to these updated
packages, which contain backported patches to correct these issues. After
installing the update, all applications using GStreamer (such as totem or
rhythmbox) must be restarted for the changes to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386
  • Red Hat Enterprise Linux Server - AUS 5.3 x86_64
  • Red Hat Enterprise Linux Server - AUS 5.3 ia64
  • Red Hat Enterprise Linux Server - AUS 5.3 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc

Fixes

  • BZ - 481267 - CVE-2009-0397 gstreamer-plugins, gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Time-to-sample (stss) atom data
  • BZ - 483736 - CVE-2009-0386 gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Composition Time To Sample (aka ctts) atom data
  • BZ - 483737 - CVE-2009-0387 gstreamer-plugins-good: Array index error while parsing malformed QuickTime media files via crafted Sync Sample (aka stss) atom data

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
x86_64
gstreamer-plugins-good-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: 863878728c04f25395ac2fd27013e6d2f78d96ee4672f264680dfe916519a94b
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: a4ac92450e3f8004bcf1284f5398cafc5ffd5b6b67a5486d33120e5d39ec1101
ia64
gstreamer-plugins-good-0.10.9-1.el5_3.1.ia64.rpm SHA-256: a20a8847f84a39afff1e2b4d2553faf658a659aa6f4b17380f36e75271db4909
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.ia64.rpm SHA-256: 1b28bb7aa65b530ed7c30380d321f88ec12c68304b2da49b9c1d92c0628a8b70
i386
gstreamer-plugins-good-0.10.9-1.el5_3.1.i386.rpm SHA-256: 6e2778fd498289ad103401b3db9aff40f91acbfbe30367272f571958e9318536
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8

Red Hat Enterprise Linux Workstation 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
x86_64
gstreamer-plugins-good-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: 863878728c04f25395ac2fd27013e6d2f78d96ee4672f264680dfe916519a94b
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: a4ac92450e3f8004bcf1284f5398cafc5ffd5b6b67a5486d33120e5d39ec1101
i386
gstreamer-plugins-good-0.10.9-1.el5_3.1.i386.rpm SHA-256: 6e2778fd498289ad103401b3db9aff40f91acbfbe30367272f571958e9318536
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8

Red Hat Enterprise Linux Desktop 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
x86_64
gstreamer-plugins-good-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: 863878728c04f25395ac2fd27013e6d2f78d96ee4672f264680dfe916519a94b
i386
gstreamer-plugins-good-0.10.9-1.el5_3.1.i386.rpm SHA-256: 6e2778fd498289ad103401b3db9aff40f91acbfbe30367272f571958e9318536

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
s390x
gstreamer-plugins-good-0.10.9-1.el5_3.1.s390x.rpm SHA-256: ca2030533b8def7cc657140432ede96e7089a3724141335707bf4f99690476e1
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.s390.rpm SHA-256: c244e872efe3891788804d8eff8a877c9ada597b6562c472769e0a4aa8d2e9e2
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.s390x.rpm SHA-256: 5a5aee8d7b9f47a6dea06e2d1b81fddbd393a48815f22c7047a47f001ef7bd69

Red Hat Enterprise Linux for Power, big endian 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
ppc
gstreamer-plugins-good-0.10.9-1.el5_3.1.ppc.rpm SHA-256: a4622ecdfc6ab977d147f9e2c8e186a27c39eb9d1136a6574ed1f51e63d02065
gstreamer-plugins-good-0.10.9-1.el5_3.1.ppc64.rpm SHA-256: 524e2621b6f81eced7c6502a53b715268d3655a8e50b28427a72ec33d1d3add2
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.ppc.rpm SHA-256: eea3baee311286b4f94602a63b7177097555461ac0ffd8fa87fd5cb24e802c31
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.ppc64.rpm SHA-256: 687d81632cfc9a87cc1dcd4a2b02e0e80e8840efe92dd8ea435e62f7083570ab

Red Hat Enterprise Linux Server from RHUI 5

SRPM
gstreamer-plugins-good-0.10.9-1.el5_3.1.src.rpm SHA-256: a7e72f866b0f4579a18c01d26753061a785912e0bd28c26106441a34fca8e1c2
x86_64
gstreamer-plugins-good-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: 863878728c04f25395ac2fd27013e6d2f78d96ee4672f264680dfe916519a94b
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.x86_64.rpm SHA-256: a4ac92450e3f8004bcf1284f5398cafc5ffd5b6b67a5486d33120e5d39ec1101
i386
gstreamer-plugins-good-0.10.9-1.el5_3.1.i386.rpm SHA-256: 6e2778fd498289ad103401b3db9aff40f91acbfbe30367272f571958e9318536
gstreamer-plugins-good-devel-0.10.9-1.el5_3.1.i386.rpm SHA-256: f05b0073b3b464a9347fea3dd61dab8a697561e48be81296370bc8dbbb0dd3c8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.