Security Advisory 2024-0017 (GHSL-2024-197, CVE-2024-47540)

Details

Usage of uninitialized stack memory in Matroska/WebM demuxer that can result in calls to uninitialized functions pointers and crashes.

Impact

It is possible for a malicious third party to trigger usage of uninitialized stack memory that can result in a crash of the application, or potentially possibly also allows code execution through stack manipulation.

Solution

The gst-plugins-good 1.24.10 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2024-47540

GStreamer releases

1.24 (current stable)

• GStreamer 1.24.10 release notes
• GStreamer Plugins Good 1.24.10

Patches

• Patch