CVE:CVE-2009-0387
CNNVD:CNNVD-200902-012
GStreamer是一套用于处理流媒体的框架。
GStreamer Good Plug-ins 程序qtdemux.c函数qtdemux_parse_samples 存在数组索引越界漏洞。远程攻击者可以通过构造存在QuickTime媒体文件.mov中的Sync Sample原子数据导致拒绝服务攻击和执行任意代码。
solution:Upgrade gstreamer good_plug-ins to a higher version than 0.10.9,0.10.10,0.10.11,and avoid the version 0.10.9,0.10.10,0.10.11; Upgrade gstreamer plug-ins to a higher version than 0.8.5,and avoid the version 0.8.5