Security Advisory 2024-0008 (GHSL-2024-235, CVE-2024-47542)
|
|
| Summary |
ID3v2 parser out-of-bounds read and NULL-pointer dereference |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-base < 1.24.10 |
| IDs |
GStreamer-SA-2024-0008
GHSL-2024-235
CVE-2024-47542 |
Details
Out-of-bounds read and NULL-pointer dereference in ID3v2 parser that can lead
to crashes for certain input files.
Impact
It is possible for a malicious third party to trigger an out-of-bounds read or
NULL-pointer dereference that can result in a crash of the application.
Solution
The gst-plugins-base 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
