Security Advisory 2024-0017 (GHSL-2024-197, CVE-2024-47540)
|
|
| Summary |
Usage of uninitialized stack memory in Matroska/WebM demuxer |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0017
GHSL-2024-197
CVE-2024-47540 |
Details
Usage of uninitialized stack memory in Matroska/WebM demuxer that can result
in calls to uninitialized functions pointers and crashes.
Impact
It is possible for a malicious third party to trigger usage of uninitialized
stack memory that can result in a crash of the application, or potentially
possibly also allows code execution through stack manipulation.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
