{"id":"USN-8205-1","summary":"gst-plugins-bad1.0 vulnerabilities","details":"It was discovered that multiple plugins in GStreamer contained arithmetic\noverflows. An attacker could possibly use this issue to cause applications\nusing the plugins to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2023-37329, CVE-2023-40474, CVE-2023-40475,\nCVE-2023-40476)\n\nIt was discovered that the MXF demuxer plugin in GStreamer did not\nproperly manage memory. An attacker could possibly use this issue to cause\napplications using the plugin to crash, resulting in a denial of service,\nor possibly execute arbitrary code. (CVE-2023-44446)\n\nIt was discovered that the H265 codec plugin in GStreamer could be made\nto write out of bounds. An attacker could possibly use this issue to\ncause applications using the plugin to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2025-3887)","modified":"2026-04-27T19:13:59.570338884Z","published":"2026-04-23T12:16:49Z","related":["UBUNTU-CVE-2023-37329","UBUNTU-CVE-2023-40474","UBUNTU-CVE-2023-40475","UBUNTU-CVE-2023-40476","UBUNTU-CVE-2023-44446","UBUNTU-CVE-2025-3887"],"upstream":["CVE-2023-37329","CVE-2023-40474","CVE-2023-40475","CVE-2023-40476","CVE-2023-44446","CVE-2025-3887","UBUNTU-CVE-2023-37329","UBUNTU-CVE-2023-40474","UBUNTU-CVE-2023-40475","UBUNTU-CVE-2023-40476","UBUNTU-CVE-2023-44446","UBUNTU-CVE-2025-3887"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8205-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-37329"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40474"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40475"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40476"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-44446"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-3887"}],"affected":[{"package":{"name":"gst-plugins-bad1.0","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/gst-plugins-bad1.0@1.8.3-1ubuntu0.2+esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.2+esm1"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.2-1ubuntu1","1.7.90-1ubuntu2","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.2"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-gst-plugins-bad-1.0","binary_version":"1.8.3-1ubuntu0.2+esm1"},{"binary_name":"gstreamer1.0-hybris","binary_version":"1.8.3-1ubuntu0.2+esm1"},{"binary_name":"gstreamer1.0-plugins-bad","binary_version":"1.8.3-1ubuntu0.2+esm1"},{"binary_name":"gstreamer1.0-plugins-bad-faad","binary_version":"1.8.3-1ubuntu0.2+esm1"},{"binary_name":"gstreamer1.0-plugins-bad-videoparsers","binary_version":"1.8.3-1ubuntu0.2+esm1"},{"binary_name":"libgstreamer-plugins-bad1.0-0","binary_version":"1.8.3-1ubuntu0.2+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-37329"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40474"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40475"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40476"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-44446"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"high"}],"id":"CVE-2025-3887"}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8205-1.json"}},{"package":{"name":"gst-plugins-bad1.0","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/gst-plugins-bad1.0@1.14.5-0ubuntu1~18.04.1+esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.1+esm1"}]}],"versions":["1.12.3-1ubuntu1","1.12.3-1ubuntu2","1.12.3-2ubuntu1","1.12.4-2ubuntu1","1.12.4-2ubuntu2","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"gir1.2-gst-plugins-bad-1.0","binary_version":"1.14.5-0ubuntu1~18.04.1+esm1"},{"binary_name":"gstreamer1.0-opencv","binary_version":"1.14.5-0ubuntu1~18.04.1+esm1"},{"binary_name":"gstreamer1.0-plugins-bad","binary_version":"1.14.5-0ubuntu1~18.04.1+esm1"},{"binary_name":"libgstreamer-opencv1.0-0","binary_version":"1.14.5-0ubuntu1~18.04.1+esm1"},{"binary_name":"libgstreamer-plugins-bad1.0-0","binary_version":"1.14.5-0ubuntu1~18.04.1+esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-37329"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40474"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40475"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-40476"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2023-44446"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"high"}],"id":"CVE-2025-3887"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8205-1.json"}}],"schema_version":"1.7.5"}