Vulnerability-Lookup

RHSA-2024:11122

Vulnerability from csaf_opensuse - Published: 2024-12-16 00:00 - Updated: 2026-09-20 11:36

Summary

security update for gstreamer1-plugins-good

Severity

Important

Notes

Title of the patch: security update for gstreamer1-plugins-good

Description of the patch: This security update provides a functional equivalent of RHSA-2024:11122. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2024:11122.

Patchnames: RHSA-2024:11122

CVE-2024-47537

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-47539

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products, the same list as for CVE-2024-47537

Threats

Impact important

CVE-2024-47540

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products, the same list as for CVE-2024-47537

Threats

Impact important

CVE-2024-47606

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products, the same list as for CVE-2024-47537

Threats

Impact important

CVE-2024-47613

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2024-47537

Threats

Impact moderate

References

19 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-47537/	self
https://www.suse.com/security/cve/CVE-2024-47539/	self
https://www.suse.com/security/cve/CVE-2024-47540/	self
https://www.suse.com/security/cve/CVE-2024-47606/	self
https://www.suse.com/security/cve/CVE-2024-47613/	self
https://www.suse.com/security/cve/CVE-2024-47537	external
https://bugzilla.suse.com/1234414	external
https://www.suse.com/security/cve/CVE-2024-47539	external
https://bugzilla.suse.com/1234417	external
https://www.suse.com/security/cve/CVE-2024-47540	external
https://bugzilla.suse.com/1234421	external
https://www.suse.com/security/cve/CVE-2024-47606	external
https://bugzilla.suse.com/1234449	external
https://www.suse.com/security/cve/CVE-2024-47613	external
https://bugzilla.suse.com/1234447	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for gstreamer1-plugins-good",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2024:11122.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2024:11122.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2024:11122",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_11122.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2024:11122",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-December/000669.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2024:11122",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-December/000669.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47537 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47537/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47539 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47539/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47540 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47540/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47606 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47606/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47613 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47613/"
      }
    ],
    "title": "security update for gstreamer1-plugins-good",
    "tracking": {
      "current_release_date": "2026-09-20T11:36:26Z",
      "generator": {
        "date": "2024-12-16T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2024:11122",
      "initial_release_date": "2024-12-16T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-12-16T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:36:26Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
                  "product_id": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gstreamer1-plugins-good@1.22.1-3.el9_5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gstreamer1-plugins-good-gtk@1.22.1-3.el9_5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
                  "product_id": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gstreamer1-plugins-good@1.22.1-3.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gstreamer1-plugins-good-gtk@1.22.1-3.el9_5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47537",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47537"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-\u003esamples to accommodate stream-\u003en_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47537",
          "url": "https://www.suse.com/security/cve/CVE-2024-47537"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234414 for CVE-2024-47537",
          "url": "https://bugzilla.suse.com/1234414"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47537"
    },
    {
      "cve": "CVE-2024-47539",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47539"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 \u003c ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop\u0027s expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47539",
          "url": "https://www.suse.com/security/cve/CVE-2024-47539"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234417 for CVE-2024-47539",
          "url": "https://bugzilla.suse.com/1234417"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47539"
    },
    {
      "cve": "CVE-2024-47540",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47540"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size \u003c 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem-\u003eallocator-\u003emem_unmap_full or mem-\u003eallocator-\u003emem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47540",
          "url": "https://www.suse.com/security/cve/CVE-2024-47540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234421 for CVE-2024-47540",
          "url": "https://bugzilla.suse.com/1234421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47540"
    },
    {
      "cve": "CVE-2024-47606",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47606"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0027slice_size\u0027 variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47606",
          "url": "https://www.suse.com/security/cve/CVE-2024-47606"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234449 for CVE-2024-47606",
          "url": "https://bugzilla.suse.com/1234449"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47606"
    },
    {
      "cve": "CVE-2024-47613",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47613"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
          "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47613",
          "url": "https://www.suse.com/security/cve/CVE-2024-47613"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234447 for CVE-2024-47613",
          "url": "https://bugzilla.suse.com/1234447"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-0:1.22.1-3.el9_5.x86_64",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.i686",
            "SUSE Liberty Linux 9:gstreamer1-plugins-good-gtk-0:1.22.1-3.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-16T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47613"
    }
  ]
}

CVE-2024-47537 (GCVE-0-2024-47537)

Vulnerability from cvelistv5 – Published: 2024-12-11 18:51 – Updated: 2025-11-03 20:39

Title

GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

Summary

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-11 19:15 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T19:15:39.558211Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T19:15:49.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:34.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-\u003esamples to accommodate stream-\u003en_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:51:56.158Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0005.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0005.html"
        }
      ],
      "source": {
        "advisory": "GHSA-2939-37w3-9rg9",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47537",
    "datePublished": "2024-12-11T18:51:56.158Z",
    "dateReserved": "2024-09-25T21:46:10.929Z",
    "dateUpdated": "2025-11-03T20:39:34.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47539 (GCVE-0-2024-47539)

Vulnerability from cvelistv5 – Published: 2024-12-11 18:53 – Updated: 2025-11-03 20:39

Title

GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a

Summary

GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 < ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop's expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-11 21:41 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47539",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:41:01.424458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:41:10.528Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:36.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 \u003c ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop\u0027s expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:53:00.750Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0007.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0007.html"
        }
      ],
      "source": {
        "advisory": "GHSA-c89v-2mmr-7cr9",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47539",
    "datePublished": "2024-12-11T18:53:00.750Z",
    "dateReserved": "2024-09-25T21:46:10.930Z",
    "dateUpdated": "2025-11-03T20:39:36.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47540 (GCVE-0-2024-47540)

Vulnerability from cvelistv5 – Published: 2024-12-11 18:54 – Updated: 2025-11-03 20:39

Title

GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer

Summary

GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-12 14:34 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47540",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:34:42.237926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:34:59.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:37.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size \u003c 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem-\u003eallocator-\u003emem_unmap_full or mem-\u003eallocator-\u003emem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "CWE-457: Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:54:04.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html"
        }
      ],
      "source": {
        "advisory": "GHSA-7r72-m3fh-rrfh",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47540",
    "datePublished": "2024-12-11T18:54:04.383Z",
    "dateReserved": "2024-09-25T21:46:10.930Z",
    "dateUpdated": "2025-11-03T20:39:37.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47606 (GCVE-0-2024-47606)

Vulnerability from cvelistv5 – Published: 2024-12-11 19:12 – Updated: 2025-11-03 20:39

Title

GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes

Summary

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-23 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2024…
https://security.netapp.com/advisory/ntap-2025041…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-24T03:55:27.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:54.545Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250418-0003/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0027slice_size\u0027 variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:12:40.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html"
        }
      ],
      "source": {
        "advisory": "GHSA-j7pq-xcp8-8qxx",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47606",
    "datePublished": "2024-12-11T19:12:40.186Z",
    "dateReserved": "2024-09-27T20:37:22.119Z",
    "dateUpdated": "2025-11-03T20:39:54.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47613 (GCVE-0-2024-47613)

Vulnerability from cvelistv5 – Published: 2024-12-11 19:14 – Updated: 2025-11-03 20:39

Title

GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush

Summary

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-12 14:17 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47613",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:17:34.089687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:17:51.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:55.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T21:34:19.223Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html"
        }
      ],
      "source": {
        "advisory": "GHSA-qvwm-8ff7-8p2v",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47613",
    "datePublished": "2024-12-11T19:14:02.436Z",
    "dateReserved": "2024-09-27T20:37:22.120Z",
    "dateUpdated": "2025-11-03T20:39:55.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:11122

CVE-2024-47537 (GCVE-0-2024-47537)

CVE-2024-47539 (GCVE-0-2024-47539)

CVE-2024-47540 (GCVE-0-2024-47540)

CVE-2024-47606 (GCVE-0-2024-47606)

CVE-2024-47613 (GCVE-0-2024-47613)

Tags

Sightings

Nomenclature

Related by attack behaviour