JVNDB-2024-000075

ORC vulnerable to stack-based buffer overflow

ORC provided by GStreamer is typically used when developing GStreamer plugins. Stack-based buffer overflow vulnerability (CWE-121) exists in orcparse.c of ORC.

Yuhei Kawakoya of NTT Security Holdings reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

GStreamer

• ORC versions prior to 0.4.39

If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

[Update the Software]
Update the software to the latest version according to the information provided by the developer.

GStreamer

• GitLab : commit fb7db9ae: Use vasprintf() if available for error messages and otherwise vsnprintf()
• GStreamer : Library of Optimized Inner Loops Runtime Compiler
• GStreamer : Orc 0.4.39 bug-fix release

1. Buffer Errors(CWE-119) [IPA Evaluation]

1. CVE-2024-40897

1. JVN : JVN#02030803

• [2024/07/26]
    Web page was published