Security Advisory 2024-0015 (GHSL-2024-244, CVE-2024-47596)
|
|
| Summary |
Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0015
GHSL-2024-244
CVE-2024-47596 |
Details
Integer underflow due to missing size checks in the MP4/MOV demuxer that can
lead to out-of-bounds reads and that can cause crashes for certain input
files.
Impact
It is possible for a malicious third party to trigger out-of-bounds reads that
can result in a crash of the application.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
