OSV-2023-420 Heap-use-after-free in fragment_addresses_equal
A heap-use-after-free vulnerability in GStreamer's fragment handling allows attackers to cause crashes or potentially execute code via crafted media streams.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is OSV-2023-420?
OSV-2023-420 is an use after free vulnerability in wireshark, published on 22 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59173
Crash type: Heap-use-after-free READ 6
Crash state:
fragment_addresses_equal
g_hash_table_lookup_extended
fragment_add_seq_single_work
Which versions are affected by OSV-2023-420?
1 open source package ship an affected version, including wireshark.
| Package | Affected | Fixed in |
|---|---|---|
wireshark OSS-Fuzz | All versions | None |
How do I fix OSV-2023-420?
No fix has been published for OSV-2023-420 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is OSV-2023-420 being exploited?
There is no known exploitation of OSV-2023-420 in the wild and no public exploit code.