Security Advisory 2024-0006 (GHSL-2024-246, CVE-2024-47598)
|
|
| Summary |
MP4/MOV sample table parser out-of-bounds read |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0006
GHSL-2024-246
CVE-2024-47598 |
Details
Out-of-bounds reads in the MP4/MOV demuxer's sample table parser when handling raw audio tracks
that can lead to crashes for certain input files.
Impact
It is possible for a malicious third party to trigger a out-of-bounds reads that result in a crash of the application.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
