Security Advisory 2024-0010 (GHSL-2024-242, CVE-2024-47545)
|
|
| Summary |
Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0010
GHSL-2024-242
CVE-2024-47545 |
Details
An integer overflow in the MP4/MOV demuxer that can lead to out-of-bounds
reads that can cause crashes for certain input files.
Impact
It is possible for a malicious third party to trigger an integer overflow that
can result in out-of-bounds reads and a crash of the application.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
