Security Advisory 2024-0007 (GHSL-2024-195, CVE-2024-47539)
|
|
| Summary |
MP4/MOV Closed Caption handling out-of-bounds write |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0007
GHSL-2024-195
CVE-2024-47539 |
Details
Out-of-bounds writes in the MP4/MOV demuxer when handling CEA608 Closed Caption
tracks that can lead to crashes for certain input files.
Impact
It is possible for a malicious third party to trigger a out-of-bounds writes
that result in a crash of the application, and possibly also allow code
execution through heap manipulation.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
