Every CVE Search/ Get API key

CVE-2024-47537

GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

8.6 HighFix available

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.96%Up 0.9 points since Dec 12, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.6

GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
CVE-2024-47537
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787, CWE-190
Updated
2026-11-02
EUVDEUVD-2024-42797 8.6

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
EUVD-2024-42797
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.6

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
CVE-2024-47537
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2024-47537 9.8

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
ALPINE-CVE-2024-47537
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-62417 9.8

CVE-2024-47537 affecting package gstreamer1 1.20.0-2

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
AZL-62417
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSV 8.6

GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
CVE-2024-47537
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-787
Updated
2026-11-04
Show 31 moreShow less
OSVDEBIAN-CVE-2024-47537 9.8

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
DEBIAN-CVE-2024-47537
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2592 9.8

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

Record
OESA-2024-2592
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2593 9.8

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

Record
OESA-2024-2593
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2594 9.8

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

Record
OESA-2024-2594
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2595 9.8

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

Record
OESA-2024-2595
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2596 9.8

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47598)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

Record
OESA-2024-2596
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11119 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11119
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11121 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11121
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11122 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11122
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11148 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11148
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11149 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11149
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11298 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11298
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11299 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11299
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11344 9.8

Red Hat Security Advisory: gstreamer1-plugins-base and gstreamer1-plugins-good security update

Record
RHSA-2024:11344
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11346 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11346
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11348 9.8

Red Hat Security Advisory: gstreamer1-plugins-good security update

Record
RHSA-2024:11348
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-47537 8.6

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.

Record
UBUNTU-CVE-2024-47537
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2024:11122 No score

Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

  • gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)
  • gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)
  • gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)
  • gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)
  • gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:11122
Updated
2026-11-02
OSVALSA-2024:11299 No score

Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

  • gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)
  • gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)
  • gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)
  • gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)
  • gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:11299
Updated
2026-11-02
OSVCLSA-2025-1764688338 No score

gstreamer1-plugins-good: Fix of CVE-2024-47537

  • CVE-2024-47537: qtdemux: fix integer overflow when allocating the samples table for fragmented MP4
Record
CLSA-2025-1764688338
Updated
2026-11-02
OSVMGASA-2025-0040 No score

Updated gstreamer1.0, gstreamer1.0-plugins-base & gstreamer1.0-plugins-good packages fix security vulnerabilities

GStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537) GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet. (CVE-2024-47538) GStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539) GStreamer uses uninitialized stack memory in Matroska/WebM demuxer. (CVE-2024-47540) GStreamer has an out-of-bounds write in SSA subtitle parser. (CVE-2024-47541) GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference. (CVE-2024-47542) GStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543) GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (CVE-2024-47544) GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read. (CVE-2024-47545) GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read. (CVE-2024-47546) GStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596) GStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597) GStreamer has an OOB-read in qtdemux_merge_sample_table. (CVE-2024-47598) GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (CVE-2024-47599) GStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600) GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47601) GStreamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (CVE-2024-47602) GStreamer NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47603) GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (CVE-2024-47606) Stack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607) GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush. (CVE-2024-47613) GStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615) GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk. (CVE-2024-47774) GStreamer has an OOB-read in parse_ds64. (CVE-2024-47775) GStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776) GStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777) GStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778) Gstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834) Gstreamer NULL-pointer dereference in LRC subtitle parser. (CVE-2024-47835)

Record
MGASA-2025-0040
Updated
2026-11-02
OSVopenSUSE-SU-2024:14578-1 No score

gstreamer-plugins-good-1.24.10-2.1 on GA media

These are all security issues fixed in the gstreamer-plugins-good-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14578-1
Updated
2026-11-02
OSVRLSA-2024:11122 No score

Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

  • gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)

  • gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)

  • gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)

  • gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)

  • gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:11122
Updated
2026-11-02
OSVRLSA-2024:11299 No score

Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

  • gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)

  • gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)

  • gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)

  • gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)

  • gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:11299
Updated
2026-11-02
OSVSUSE-SU-2025:00063-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
  • CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
  • CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
  • CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
  • CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
  • CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
  • CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
  • CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
  • CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
  • CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
  • CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
  • CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
  • CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
  • CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)
Record
SUSE-SU-2025:00063-1
Updated
2026-11-02
OSVSUSE-SU-2025:0055-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
  • CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
  • CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)
  • CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
  • CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
  • CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
  • CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
  • CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
  • CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
  • CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)
  • CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
  • CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
  • CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
  • CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
  • CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
  • CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)
Record
SUSE-SU-2025:0055-1
Updated
2026-11-02
OSVSUSE-SU-2025:0063-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
  • CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
  • CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
  • CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
  • CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
  • CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
  • CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
  • CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
  • CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
  • CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
  • CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
  • CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
  • CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
  • CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)
Record
SUSE-SU-2025:0063-1
Updated
2026-11-02
OSVSUSE-SU-2025:0064-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
  • CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
  • CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)
  • CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
  • CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
  • CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
  • CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)
  • CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
  • CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
  • CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
  • CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
  • CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
  • CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
  • CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
  • CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
  • CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
  • CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)
Record
SUSE-SU-2025:0064-1
Updated
2026-11-02
OSVSUSE-SU-2025:0067-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
  • CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
  • CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)
  • CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
  • CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
  • CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
  • CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)
  • CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
  • CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
  • CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
  • CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
  • CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
  • CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
  • CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
  • CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
  • CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
  • CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)
Record
SUSE-SU-2025:0067-1
Updated
2026-11-02
OSVSUSE-SU-2025:02055-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2024-47537: Fixed OOB-write in isomp4/qtdemux.c (bsc#1234414)
  • CVE-2024-47539: Fixed OOB-write in convert_to_s334_1a (bsc#1234417)
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421)
  • CVE-2024-47543: Fixed OOB-read in qtdemux_parse_container (bsc#1234462)
  • CVE-2024-47544: Fixed NULL-pointer dereferences in MP4/MOV demuxer CENC handling (bsc#1234473)
  • CVE-2024-47545: Fixed integer underflow in FOURCC_strf parsing leading to OOB-read (bsc#1234476)
  • CVE-2024-47546: Fixed integer underflow in extract_cc_from_data leading to OOB-read (bsc#1234477)
  • CVE-2024-47596: Fixed integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads (bsc#1234424)
  • CVE-2024-47597: Fixed OOB-reads in MP4/MOV demuxer sample table parser (bsc#1234425)
  • CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (bsc#1234427)
  • CVE-2024-47601: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234428)
  • CVE-2024-47602: Fixed NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (bsc#1234432)
  • CVE-2024-47603: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234433)
  • CVE-2024-47606: Fixed integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (bsc#1234449)
  • CVE-2024-47613: Fixed NULL-pointer dereference in gdk-pixbuf decoder (bsc#1234447)
  • CVE-2024-47774: Fixed integer overflow in AVI subtitle parser that leads to out-of-bounds reads (bsc#1234446)
  • CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser (bsc#1234434)
  • CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser (bsc#1234435)
  • CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser (bsc#1234436)
  • CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser (bsc#1234439)
  • CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files (bsc#1234440)
Record
SUSE-SU-2025:02055-1
Updated
2026-11-02
OSVUSN-7176-1 No score

gst-plugins-good1.0 vulnerabilities

Antonio Morales discovered that GStreamer Good Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-7176-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-good
Alpine:v3.20
 before 1.24.10-r0
1.24.10-r0
gst-plugins-good
Alpine:v3.21
 before 1.24.10-r0
1.24.10-r0
gst-plugins-good
Alpine:v3.22
 before 1.24.10-r0
1.24.10-r0
gst-plugins-good
Alpine:v3.23
 before 1.24.10-r0
1.24.10-r0
gst-plugins-good
Alpine:v3.24
 before 1.24.10-r0
1.24.10-r0
gstreamer1-plugins-good
AlmaLinux:9
From an advisory covering 5 CVEs
 before 1.22.1-3.el9_5
1.22.1-3.el9_5
gstreamer1-plugins-good-gtk
AlmaLinux:9
From an advisory covering 5 CVEs
 before 1.22.1-3.el9_5
1.22.1-3.el9_5
gstreamer1-plugins-good
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.16.1-5.el8_10
1.16.1-5.el8_10
gstreamer1-plugins-good-gtk
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.16.1-5.el8_10
1.16.1-5.el8_10
gstreamer1
Azure Linux:3
 through 1.20.0-2 None known
Show 121 moreShow less
Affected packages
PackageAffectedFixed
gstreamer1-plugins-good
TuxCare:OracleLinux:7
 before 1.10.4-2.el7.tuxcare.els2
1.10.4-2.el7.tuxcare.els2
gst-plugins-good1.0
Debian:12
 before 1.22.0-5+deb12u2, plus listed versions
1.22.0-51.22.0-5+deb12u1
1.22.0-5+deb12u2
gst-plugins-good1.0
Debian:13
 before 1.24.10-1
1.24.10-1
gst-plugins-good1.0
Debian:14
 before 1.24.10-1
1.24.10-1
gst-plugins-good1.0
Debian:11
From an advisory covering 22 CVEs
 before 1.18.4-2+deb11u3, plus listed versions
1.18.4-21.18.4-2+deb11u11.18.4-2+deb11u2
1.18.4-2+deb11u3
gst-plugins-good1.0
Debian:12
From an advisory covering 22 CVEs
 before 1.22.0-5+deb12u2, plus listed versions
1.22.0-51.22.0-5+deb12u1
1.22.0-5+deb12u2
gstreamer1.0
Mageia:9
From an advisory covering 21 CVEs
 before 1.22.11-1.1.mga9
1.22.11-1.1.mga9
gstreamer1.0-plugins-base
Mageia:9
From an advisory covering 21 CVEs
 before 1.22.11-1.2.mga9
1.22.11-1.2.mga9
gstreamer1.0-plugins-good
Mageia:9
From an advisory covering 21 CVEs
 before 1.22.11-1.1.mga9
1.22.11-1.1.mga9
gstreamer1-plugins-good
openEuler:22.03-LTS-SP4
From an advisory covering 21 CVEs
 before 1.16.2-8.oe2203sp4
1.16.2-8.oe2203sp4
gstreamer1-plugins-good
openEuler:22.03-LTS-SP3
From an advisory covering 21 CVEs
 before 1.16.2-8.oe2203sp3
1.16.2-8.oe2203sp3
gstreamer1-plugins-good
openEuler:20.03-LTS-SP4
From an advisory covering 21 CVEs
 before 1.16.2-8.oe2003sp4
1.16.2-8.oe2003sp4
gstreamer1-plugins-good
openEuler:22.03-LTS-SP1
From an advisory covering 21 CVEs
 before 1.16.2-8.oe2203sp1
1.16.2-8.oe2203sp1
gstreamer1-plugins-good
openEuler:24.03-LTS
From an advisory covering 22 CVEs
 before 1.20.3-4.oe2403
1.20.3-4.oe2403
gstreamer1-plugins-good
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good-debugsource
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good-gtk
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good-qt-debuginfo
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-7.el9_2
0:1.18.4-7.el9_2
gstreamer1-plugins-good
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good-gtk
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good-qt-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_4
0:1.22.1-3.el9_4
gstreamer1-plugins-good
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good-qt-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-2.el8_2
0:1.16.1-2.el8_2
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-2.el8_2
0:1.16.1-2.el8_2
gstreamer1-plugins-good-debugsource
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-2.el8_2
0:1.16.1-2.el8_2
gstreamer1-plugins-good-gtk
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-2.el8_2
0:1.16.1-2.el8_2
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-2.el8_2
0:1.16.1-2.el8_2
gstreamer1-plugins-good
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debugsource
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-debugsource
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_6
0:1.16.1-3.el8_6
gstreamer1-plugins-good
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good-debugsource
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good-gtk
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good-qt-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 5 CVEs
 before 0:1.18.4-6.el9_0
0:1.18.4-6.el9_0
gstreamer1-plugins-good
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer1-plugins-base
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-base-debuginfo
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-base-devel
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-good
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-base-devel-docs
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-base-tools
Red Hat:rhel_els:7
From an advisory covering 7 CVEs
 before 0:1.10.4-3.el7_9
0:1.10.4-3.el7_9
gstreamer1-plugins-good
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debugsource
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-debugsource
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-3.el8_4
0:1.16.1-3.el8_4
gstreamer1-plugins-good
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-4.el8_8
0:1.16.1-4.el8_8
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-4.el8_8
0:1.16.1-4.el8_8
gstreamer1-plugins-good-debugsource
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-4.el8_8
0:1.16.1-4.el8_8
gstreamer1-plugins-good-gtk
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-4.el8_8
0:1.16.1-4.el8_8
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 5 CVEs
 before 0:1.16.1-4.el8_8
0:1.16.1-4.el8_8
gstreamer1-plugins-good
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:1.22.1-3.el9_5
0:1.22.1-3.el9_5
gstreamer1-plugins-good
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:1.16.1-5.el8_10
0:1.16.1-5.el8_10
gstreamer-plugins-good
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 19 CVEs
 before 1.8.3-16.12.1
1.8.3-16.12.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 19 CVEs
 before 1.8.3-16.12.1
1.8.3-16.12.1
gstreamer-plugins-good
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 22 CVEs
 before 1.24.0-150600.3.3.1
1.24.0-150600.3.3.1
gstreamer-plugins-good
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 22 CVEs
 before 1.24.0-150600.3.3.1
1.24.0-150600.3.3.1
gstreamer-plugins-good
openSUSE:Leap 15.6
From an advisory covering 22 CVEs
 before 1.24.0-150600.3.3.1
1.24.0-150600.3.3.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 22 CVEs
 before 1.22.0-150500.4.6.1
1.22.0-150500.4.6.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 22 CVEs
 before 1.22.0-150500.4.6.1
1.22.0-150500.4.6.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 22 CVEs
 before 1.22.0-150500.4.6.1
1.22.0-150500.4.6.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 22 CVEs
 before 1.22.0-150500.4.6.1
1.22.0-150500.4.6.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Manager Proxy 4.3
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Manager Server 4.3
From an advisory covering 22 CVEs
 before 1.20.1-150400.3.9.1
1.20.1-150400.3.9.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 21 CVEs
 before 1.16.3-150200.3.17.1
1.16.3-150200.3.17.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 21 CVEs
 before 1.16.3-150200.3.17.1
1.16.3-150200.3.17.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 21 CVEs
 before 1.16.3-150200.3.17.1
1.16.3-150200.3.17.1
gstreamer-plugins-good
SUSE:Enterprise Storage 7.1
From an advisory covering 21 CVEs
 before 1.16.3-150200.3.17.1
1.16.3-150200.3.17.1
gst-plugins-good1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1
Show 14 moreShow less
1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.2-1ubuntu0.31.8.3-1ubuntu0.31.8.3-1ubuntu0.41.8.3-1ubuntu0.51.8.3-1ubuntu0.5+esm11.8.3-1ubuntu0.5+esm21.8.3-1ubuntu0.5+esm31.8.3-1ubuntu0.5+esm4
 None known
gst-plugins-good0.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.31-3+nmu4ubuntu2~gcc5.10.10.31-3+nmu4ubuntu2.16.04.10.10.31-3+nmu4ubuntu2.16.04.20.10.31-3+nmu4ubuntu2.16.04.3
 None known
gst-plugins-good1.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.3-1ubuntu11.12.4-1ubuntu11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu1
Show 9 moreShow less
1.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.21.14.5-0ubuntu1~18.04.31.14.5-0ubuntu1~18.04.3+esm11.14.5-0ubuntu1~18.04.3+esm21.14.5-0ubuntu1~18.04.3+esm31.14.5-0ubuntu1~18.04.3+esm4
 None known
gst-plugins-good1.0
Ubuntu:20.04:LTS
 before 1.16.3-0ubuntu1.3, plus listed versions
1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu21.16.2-1ubuntu2.11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.2
1.16.3-0ubuntu1.3
gst-plugins-good1.0
Ubuntu:22.04:LTS
 before 1.20.3-0ubuntu1.3, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.1
1.20.3-0ubuntu1.3
gst-plugins-good1.0
Ubuntu:24.04:LTS
 before 1.24.2-1ubuntu1.1, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu51.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu1
1.24.2-1ubuntu1.1
gst-plugins-good1.0
Ubuntu:20.04:LTS
From an advisory covering 22 CVEs
 before 1.16.3-0ubuntu1.3, plus listed versions
1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu21.16.2-1ubuntu2.11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.2
1.16.3-0ubuntu1.3
gst-plugins-good1.0
Ubuntu:22.04:LTS
From an advisory covering 22 CVEs
 before 1.20.3-0ubuntu1.3, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.1
1.20.3-0ubuntu1.3
gst-plugins-good1.0
Ubuntu:24.04:LTS
From an advisory covering 22 CVEs
 before 1.24.2-1ubuntu1.1, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu51.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu1
1.24.2-1ubuntu1.1
gstreamer-plugins-good
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.24.10-2.1
1.24.10-2.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47537 is a high vulnerability (CVSS 8.6) in Gstreamer, published December 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in gst-plugins-good 1.24.10-r0.

References

Show 185 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open