CVE catalog

CVE-2023-37328

gst-plugins-base1.0: CVE-2023-37328

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.05% · Oct 25, 2026

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20994.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangst-plugins-base1.0sid1.28.8-1fixed
Debiangst-plugins-base1.0forky1.28.8-1fixed
Debiangst-plugins-base1.0trixie1.26.2-1+deb13u1fixed
Debiangst-plugins-base1.0trixie-security1.26.2-1+deb13u2fixed
Debiangst-plugins-base1.0bookworm1.22.0-3+deb12u6fixed
Debiangst-plugins-base1.0bookworm-security1.22.0-3+deb12u7fixed
Ubuntugst-plugins-base0.1016.040.10.36-2vulnerable
Ubuntugst-plugins-base0.1016.040.10.36-2ubuntu0.1vulnerable
Ubuntugst-plugins-base0.1016.040.10.36-2ubuntu0.2vulnerable
Ubuntugst-plugins-base1.0pro1.12.3-1vulnerable
Ubuntugst-plugins-base1.0pro1.12.4-1vulnerable
Ubuntugst-plugins-base1.0pro1.13.1-1ubuntu1vulnerable
Ubuntugst-plugins-base1.0pro1.13.91-1ubuntu1vulnerable
Ubuntugst-plugins-base1.0pro1.14.0-1ubuntu1vulnerable
Ubuntugst-plugins-base1.0pro1.14.0-2ubuntu1vulnerable
Ubuntugst-plugins-base1.0pro1.14.1-1ubuntu1~ubuntu18.04.1vulnerable
Ubuntugst-plugins-base1.0pro1.14.1-1ubuntu1~ubuntu18.04.2vulnerable
Ubuntugst-plugins-base1.0pro1.14.4-1ubuntu1.1~ubuntu18.04.1vulnerable
Ubuntugst-plugins-base1.0pro1.14.5-0ubuntu1~18.04.1vulnerable
Ubuntugst-plugins-base1.0pro1.14.5-0ubuntu1~18.04.2vulnerable
Ubuntugst-plugins-base1.0pro1.14.5-0ubuntu1~18.04.3vulnerable
Ubuntugst-plugins-base1.0pro1.14.5-0ubuntu1~18.04.3+esm1fixed
Ubuntugst-plugins-base1.020.041.16.1-1vulnerable
Ubuntugst-plugins-base1.020.041.16.2-1vulnerable
Ubuntugst-plugins-base1.020.041.16.2-2vulnerable
Ubuntugst-plugins-base1.020.041.16.2-2ubuntu3vulnerable
Ubuntugst-plugins-base1.020.041.16.2-2ubuntu4vulnerable
Ubuntugst-plugins-base1.020.041.16.2-4vulnerable
Ubuntugst-plugins-base1.020.041.16.2-4ubuntu0.1vulnerable
Ubuntugst-plugins-base1.020.041.16.3-0ubuntu1vulnerable
Ubuntugst-plugins-base1.020.041.16.3-0ubuntu1.1vulnerable
Ubuntugst-plugins-base1.020.041.16.3-0ubuntu1.2fixed
Ubuntugst-plugins-base1.022.041.18.5-1vulnerable
Ubuntugst-plugins-base1.022.041.19.90-1vulnerable
Ubuntugst-plugins-base1.022.041.20.0-1vulnerable
Ubuntugst-plugins-base1.022.041.20.0-2vulnerable
Ubuntugst-plugins-base1.022.041.20.1-1vulnerable
Ubuntugst-plugins-base1.022.041.20.1-1ubuntu0.1fixed
Susegstreamer-plugins-baselinux enterprise software development kit 12 sp51.8.3-13.12.1fixed
Susegstreamer-plugins-baselinux enterprise server 12 sp51.8.3-13.12.1fixed
Susegstreamer-plugins-baselinux enterprise server for sap applications 12 sp51.8.3-13.12.1fixed
Susegstreamer-plugins-baselinux enterprise workstation extension 12 sp51.8.3-13.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangst-plugins-base1.0sourcesid1.22.4-1not yet assignedNot reportedNot reported
Debiangst-plugins-base1.0sourceforky1.22.4-1not yet assignedNot reportedNot reported
Debiangst-plugins-base1.0sourcetrixie1.22.4-1not yet assignedNot reportedNot reported
Debiangst-plugins-base1.0sourcebookworm1.22.0-3+deb12u1not yet assignedNot reportedNot reported
Ubuntugst-plugins-base1.0debpro1.14.5-0ubuntu1~18.04.3+esm1Not reportedUBUNTU-CVE-2023-37328Not reported
Ubuntugst-plugins-base1.0deb20.041.16.3-0ubuntu1.2Not reportedUBUNTU-CVE-2023-37328Not reported
Ubuntugst-plugins-base1.0deb22.041.20.1-1ubuntu0.1Not reportedUBUNTU-CVE-2023-37328Not reported
Susegstreamer-plugins-baserpmlinux enterprise software development kit 12 sp51.8.3-13.12.1Not reportedSUSE-SU-2023:3402-1Not reported
Susegstreamer-plugins-baserpmlinux enterprise server 12 sp51.8.3-13.12.1Not reportedSUSE-SU-2023:3402-1Not reported
Susegstreamer-plugins-baserpmlinux enterprise server for sap applications 12 sp51.8.3-13.12.1Not reportedSUSE-SU-2023:3402-1Not reported
Susegstreamer-plugins-baserpmlinux enterprise workstation extension 12 sp51.8.3-13.12.1Not reportedSUSE-SU-2023:3402-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]