Security Advisory 2024-0005 (GHSL-2024-094, GHSL-2024-237, GHSL-2024-241, CVE-2024-47537)
|
|
| Summary |
Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0005
GHSL-2024-094, GHSL-2024-237, GHSL-2024-241
CVE-2024-47537 |
Details
Integer overflow in the MP4/MOV demuxer's sample table parser that can lead to
out-of-bounds writes and NULL-pointer dereferences for certain input files.
Impact
It is possible for a malicious third party to trigger an out-of-bounds write or
NULL-pointer dereferences that result in a crash of the application, and, in
case of out-of-bounds writes, possibly also allow code execution through heap
manipulation.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
