Security Advisory 2024-0019 (GHSL-2024-250, CVE-2024-47602)
|
|
| Summary |
NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer |
| Date |
2024-12-03 20:00 |
| Affected Versions |
GStreamer gst-plugins-good < 1.24.10 |
| IDs |
GStreamer-SA-2024-0019
GHSL-2024-250
CVE-2024-47602 |
Details
NULL-pointer dereferences and out-of-bounds reads in the Matroska/WebM demuxer that can cause
crashes for certain input files.
Impact
It is possible for a malicious third party to trigger NULL-pointer dereferences and out-of-bounds
reads that can result in a crash of the application.
Solution
The gst-plugins-good 1.24.10 release addresses the issue. People using older
branches of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.24 (current stable)
Patches
