Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU57488
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-3522
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the JavaFX (GStreamer) component in Java SE. A local non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
MitigationUpdate the affected package gstreamer-plugins-base to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 15: SP1
SUSE Linux Enterprise Server 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise Server 15: SP1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise High Performance Computing 15: SP1
SUSE CaaS Platform: 4.0
openSUSE Leap: 15.4
gstreamer-plugins-base-lang: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstApp-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0: before 1.12.5-150000.3.6.1
libgstfft-1_0-0: before 1.12.5-150000.3.6.1
libgstapp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstriff-1_0-0: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debugsource: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtsp-1_0: before 1.12.5-150000.3.6.1
libgstriff-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgsttag-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base: before 1.12.5-150000.3.6.1
typelib-1_0-GstTag-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstPbutils-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-devel: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtp-1_0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstfft-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstVideo-1_0: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0: before 1.12.5-150000.3.6.1
libgsttag-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstAudio-1_0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debuginfo: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstapp-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstAllocators-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstSdp-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstFft-1_0: before 1.12.5-150000.3.6.1
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20233801-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77964
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-37327
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the FLAC parser when handling malformed image tags. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package gstreamer-plugins-base to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 15: SP1
SUSE Linux Enterprise Server 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise Server 15: SP1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise High Performance Computing 15: SP1
SUSE CaaS Platform: 4.0
openSUSE Leap: 15.4
gstreamer-plugins-base-lang: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstApp-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0: before 1.12.5-150000.3.6.1
libgstfft-1_0-0: before 1.12.5-150000.3.6.1
libgstapp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstriff-1_0-0: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debugsource: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtsp-1_0: before 1.12.5-150000.3.6.1
libgstriff-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgsttag-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base: before 1.12.5-150000.3.6.1
typelib-1_0-GstTag-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstPbutils-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-devel: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtp-1_0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstfft-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstVideo-1_0: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0: before 1.12.5-150000.3.6.1
libgsttag-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstAudio-1_0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debuginfo: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstapp-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstAllocators-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstSdp-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstFft-1_0: before 1.12.5-150000.3.6.1
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20233801-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77966
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-37328
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the PGS blu-ray subtitle decoder when handling certain files. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package gstreamer-plugins-base to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 15: SP1
SUSE Linux Enterprise Server 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise Server 15: SP1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS: 15-SP1
SUSE Linux Enterprise High Performance Computing 15: SP1
SUSE CaaS Platform: 4.0
openSUSE Leap: 15.4
gstreamer-plugins-base-lang: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstApp-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0: before 1.12.5-150000.3.6.1
libgstfft-1_0-0: before 1.12.5-150000.3.6.1
libgstapp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstrtsp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstriff-1_0-0: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debugsource: before 1.12.5-150000.3.6.1
libgstvideo-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstpbutils-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtsp-1_0: before 1.12.5-150000.3.6.1
libgstriff-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgsttag-1_0-0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base: before 1.12.5-150000.3.6.1
typelib-1_0-GstTag-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstPbutils-1_0: before 1.12.5-150000.3.6.1
libgstrtp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-devel: before 1.12.5-150000.3.6.1
typelib-1_0-GstRtp-1_0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0: before 1.12.5-150000.3.6.1
libgstaudio-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstfft-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstVideo-1_0: before 1.12.5-150000.3.6.1
libgstallocators-1_0-0: before 1.12.5-150000.3.6.1
libgsttag-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
typelib-1_0-GstAudio-1_0: before 1.12.5-150000.3.6.1
gstreamer-plugins-base-debuginfo: before 1.12.5-150000.3.6.1
libgstsdp-1_0-0-debuginfo: before 1.12.5-150000.3.6.1
libgstapp-1_0-0: before 1.12.5-150000.3.6.1
typelib-1_0-GstAllocators-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstSdp-1_0: before 1.12.5-150000.3.6.1
typelib-1_0-GstFft-1_0: before 1.12.5-150000.3.6.1
External linkshttp://www.suse.com/support/update/announcement/2023/suse-su-20233801-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.