CVE catalog

CVE-2021-3497

gst-plugins-good1.0: CVE-2021-3497

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Mar 15, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.22% · Oct 25, 2026

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gst-plugins-good1.0	sid	`1.28.8-1`	fixed
Debian	gst-plugins-good1.0	forky	`1.28.8-1`	fixed
Debian	gst-plugins-good1.0	trixie	`1.26.2-1+deb13u2`	fixed
Debian	gst-plugins-good1.0	trixie-security	`1.26.2-1+deb13u2`	fixed
Debian	gst-plugins-good1.0	bookworm	`1.22.0-5+deb12u3`	fixed
Debian	gst-plugins-good1.0	bookworm-security	`1.22.0-5+deb12u4`	fixed
Alpine	gstreamer	3.13	`1.18.4-r0`	fixed
Alpine	gstreamer	3.14	`1.18.4-r0`	fixed
Alpine	gstreamer	3.15	`1.18.4-r0`	fixed
Alpine	gstreamer	3.16	`1.18.4-r0`	fixed
Alpine	gstreamer	3.17	`1.18.4-r0`	fixed
Alpine	gstreamer	3.18	`1.18.4-r0`	fixed
Alpine	gstreamer	3.19	`1.18.4-r0`	fixed
Alpine	gstreamer	3.20	`1.18.4-r0`	fixed
Alpine	gstreamer	3.21	`1.18.4-r0`	fixed
Alpine	gstreamer	3.22	`1.18.4-r0`	fixed
Alpine	gstreamer	3.23	`1.18.4-r0`	fixed
Alpine	gstreamer	3.24	`1.18.4-r0`	fixed
Ubuntu	gst-plugins-good1.0	16.04	`1.6.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.6.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.6.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.90-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.91-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.1-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.2`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.3`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.3`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.4`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.5`	fixed
Ubuntu	gst-plugins-good1.0	18.04	`1.12.3-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.12.4-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.13.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.13.91-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.1-1ubuntu1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.4-1ubuntu1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.5-0ubuntu1~18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.5-0ubuntu1~18.04.2`	fixed
Ubuntu	gst-plugins-good1.0	20.04	`1.16.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu2.1`	fixed
Ubuntu	gst-plugins-good1.0	16.04	`1.6.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.6.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.6.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.90-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.7.91-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.1-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.2`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.2-1ubuntu0.3`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.3`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.4`	vulnerable
Ubuntu	gst-plugins-good1.0	16.04	`1.8.3-1ubuntu0.5`	fixed
Ubuntu	gst-plugins-good1.0	18.04	`1.12.3-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.12.4-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.13.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.13.91-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.1-1ubuntu1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.4-1ubuntu1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.5-0ubuntu1~18.04.1`	vulnerable
Ubuntu	gst-plugins-good1.0	18.04	`1.14.5-0ubuntu1~18.04.2`	fixed
Ubuntu	gst-plugins-good1.0	20.04	`1.16.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-good1.0	20.04	`1.16.2-1ubuntu2.1`	fixed
Suse	gstreamer-plugins-good	linux enterprise server 15 sp1-ltss	`1.12.5-150000.3.7.2`	fixed
Suse	gstreamer-plugins-good	linux enterprise server for sap applications 15 sp1	`1.12.5-150000.3.7.2`	fixed
Suse	gstreamer-plugins-good	linux enterprise module for basesystem 15 sp2	`1.16.3-3.6.1`	fixed
Suse	gstreamer-plugins-good	linux enterprise module for basesystem 15 sp3	`1.16.3-3.6.1`	fixed
Opensuse	gstreamer-plugins-good	leap 15.3	`1.16.3-3.6.1`	fixed
Suse	gstreamer-plugins-good	linux enterprise server 12 sp5	`1.8.3-16.3.1`	fixed
Suse	gstreamer-plugins-good	linux enterprise server for sap applications 12 sp5	`1.8.3-16.3.1`	fixed
Opensuse	gstreamer-plugins-good	leap 15.2	`1.16.3-lp152.2.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gst-plugins-good1.0	source	sid	`1.18.4-2`	not yet assigned	Not reported	[986910]
Debian	gst-plugins-good1.0	source	forky	`1.18.4-2`	not yet assigned	Not reported	[986910]
Debian	gst-plugins-good1.0	source	trixie	`1.18.4-2`	not yet assigned	Not reported	[986910]
Debian	gst-plugins-good1.0	source	bookworm	`1.18.4-2`	not yet assigned	Not reported	[986910]
Alpine	gstreamer	apk	3.13	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.14	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.15	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.16	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.17	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.18	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.19	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.20	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.21	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.22	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.23	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Alpine	gstreamer	apk	3.24	`1.18.4-r0`	Not reported	ALPINE-CVE-2021-3497	Not reported
Ubuntu	gst-plugins-good1.0	deb	16.04	`1.8.3-1ubuntu0.5`	Not reported	UBUNTU-CVE-2021-3497	Not reported
Ubuntu	gst-plugins-good1.0	deb	18.04	`1.14.5-0ubuntu1~18.04.2`	Not reported	UBUNTU-CVE-2021-3497	Not reported
Ubuntu	gst-plugins-good1.0	deb	20.04	`1.16.2-1ubuntu2.1`	Not reported	UBUNTU-CVE-2021-3497	Not reported
Ubuntu	gst-plugins-good1.0	deb	16.04	`1.8.3-1ubuntu0.5`	Not reported	USN-4928-1	Not reported
Ubuntu	gst-plugins-good1.0	deb	18.04	`1.14.5-0ubuntu1~18.04.2`	Not reported	USN-4928-1	Not reported
Ubuntu	gst-plugins-good1.0	deb	20.04	`1.16.2-1ubuntu2.1`	Not reported	USN-4928-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise server 15 sp1-ltss	`1.12.5-150000.3.7.2`	Not reported	SUSE-SU-2023:3688-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise server for sap applications 15 sp1	`1.12.5-150000.3.7.2`	Not reported	SUSE-SU-2023:3688-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise module for basesystem 15 sp2	`1.16.3-3.6.1`	Not reported	SUSE-SU-2021:2915-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise module for basesystem 15 sp3	`1.16.3-3.6.1`	Not reported	SUSE-SU-2021:2915-1	Not reported
Opensuse	gstreamer-plugins-good	rpm	leap 15.3	`1.16.3-3.6.1`	Not reported	OPENSUSE-SU-2021:2915-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise server 12 sp5	`1.8.3-16.3.1`	Not reported	SUSE-SU-2021:2916-1	Not reported
Suse	gstreamer-plugins-good	rpm	linux enterprise server for sap applications 12 sp5	`1.8.3-16.3.1`	Not reported	SUSE-SU-2021:2916-1	Not reported
Opensuse	gstreamer-plugins-good	rpm	leap 15.2	`1.16.3-lp152.2.6.1`	Not reported	OPENSUSE-SU-2021:1230-1	Not reported

[Debian bug #986910]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[gstreamer1.0-gtk3]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.22.0-5+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
[gstreamer1.0-plugins-good]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.22.0-5+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
[gstreamer1.0-pulseaudio]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.22.0-5+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
[gstreamer1.0-qt5]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.22.0-5+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
[gstreamer1.0-qt6]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.22.0-5+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12
- 1.22.0-5+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · bookworm; dsa · gst-plugins-good1.0 · debian · 12

[Debian 13 (Trixie)]

[gstreamer1.0-gtk3]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.26.2-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
[gstreamer1.0-plugins-good]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.26.2-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
[gstreamer1.0-pulseaudio]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.26.2-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
[gstreamer1.0-qt5]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.26.2-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
[gstreamer1.0-qt6]Unknown
Source package: [gst-plugins-good1.0]
Details (4)
- 1.26.2-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13
- 1.26.2-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 1.18.4-2
  dsa · gst-plugins-good1.0 · debian · 13

Observed: Oct 23, 2026, 5:58:22 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]