Security Advisory 2024-0011 (GHSL-2024-238, GHSL-2024-239, GHSL-2024-240, CVE-2024-47544)
|
|
| Summary |
NULL-pointer dereferences in MP4/MOV demuxer CENC handling |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0011
GHSL-2024-238, GHSL-2024-239, GHSL-2024-240
CVE-2024-47544 |
Details
Multiple NULL-pointer dereferences in the MP4/MOV demuxer's CENC handling that
can cause crashes for certain input files.
Impact
It is possible for a malicious third party to trigger a NULL-pointer
dereferences that can result in a crash of the application.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
