Log in Start free

Vulnerability · Published Jul 19, 2022 · Assigned by redhat

CVE-2022-2122

High 7.8

In plain English

A high-severity heap buffer overflow in GStreamer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gstreamer1-plugins-good1.18.4-6.el9ALSA-2023:2260
AlmaLinux:9gstreamer1-plugins-good-gtk1.18.4-6.el9ALSA-2023:2260
Alpine:v3.20gst-plugins-good1.20.3-r0ALPINE-CVE-2022-2122
Alpine:v3.21gst-plugins-good1.20.3-r0ALPINE-CVE-2022-2122
Alpine:v3.22gst-plugins-good1.20.3-r0ALPINE-CVE-2022-2122
Alpine:v3.23gst-plugins-good1.20.3-r0ALPINE-CVE-2022-2122
Alpine:v3.24gst-plugins-good1.20.3-r0ALPINE-CVE-2022-2122
Debian:12gst-plugins-good1.01.20.3-1DEBIAN-CVE-2022-2122
Debian:13gst-plugins-good1.01.20.3-1DEBIAN-CVE-2022-2122
Debian:14gst-plugins-good1.01.20.3-1DEBIAN-CVE-2022-2122
Ubuntu:22.04:LTSgst-plugins-good1.01.20.3-0ubuntu1UBUNTU-CVE-2022-2122
Ubuntu:22.04:LTSopenjfxno fix listedUBUNTU-CVE-2022-2122
Ubuntu:24.04:LTSopenjfxno fix listedUBUNTU-CVE-2022-2122
Ubuntu:25.10openjfxno fix listedUBUNTU-CVE-2022-2122
Ubuntu:26.04:LTSopenjfxno fix listedUBUNTU-CVE-2022-2122
Ubuntu:26.10openjfxno fix listedUBUNTU-CVE-2022-2122

Affected products (as reported)

VendorProductVersions
n/a GStreamer 1.20.3

Weakness: CWE-122

References