GStreamer Plugins Good MP4 Audio Track Parsing Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in GStreamer gst-plugins-good versions prior to 1.28.2. The issue arises in the isomp4 plugin's qtdemux_audio_caps function, which improperly validates atom data when parsing MP4 audio tracks. This lack of validation allows for division operations to be performed on zero values, leading to integer division by zero and causing a crash.

Impact

Exploitation of this vulnerability leads to a crash of the application, causing a denial-of-service condition. Additionally, the out-of-bounds memory accesses could potentially allow for information disclosure.

Remediation

Users can upgrade to GStreamer gst-plugins-good version 1.28.2 to address this vulnerability. Instructions for downloading this version are available on the GStreamer website.