CVE-2022-1923 Integer overflow in GStreamer
An integer overflow in GStreamer's Matroska demuxer can cause a crash or heap overwrite, potentially leading to denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1923?
CVE-2022-1923 is a high-severity vulnerability in Debian Debian Linux, published on 19 Jul 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
Which versions are affected by CVE-2022-1923?
It affects 2 products.
Products include Debian Debian Linux, Gstreamer Gstreamer.
How do I fix CVE-2022-1923?
Apply the vendor's patch.
Is CVE-2022-1923 being exploited?
There is no known exploitation of CVE-2022-1923 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-QO62654, DEBIAN-CVE-2022-1923, GHSA-j6v3-2c6w-pwpm, UBUNTU-CVE-2022-1923.