CVE-2024-47538

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.

Security Fix(es):

(CVE-2024-47538)

(CVE-2024-47541)

(CVE-2024-47542)

(CVE-2024-47600)

(CVE-2024-47607)

(CVE-2024-47615)

(CVE-2024-47835)

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-47538: fix stack-buffer overflow in vorbis_handle_identification_packet function by limiting writing beyond boundaries of position array

GStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537) GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet. (CVE-2024-47538) GStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539) GStreamer uses uninitialized stack memory in Matroska/WebM demuxer. (CVE-2024-47540) GStreamer has an out-of-bounds write in SSA subtitle parser. (CVE-2024-47541) GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference. (CVE-2024-47542) GStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543) GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (CVE-2024-47544) GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read. (CVE-2024-47545) GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read. (CVE-2024-47546) GStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596) GStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597) GStreamer has an OOB-read in qtdemux_merge_sample_table. (CVE-2024-47598) GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (CVE-2024-47599) GStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600) GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47601) GStreamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (CVE-2024-47602) GStreamer NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47603) GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (CVE-2024-47606) Stack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607) GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush. (CVE-2024-47613) GStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615) GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk. (CVE-2024-47774) GStreamer has an OOB-read in parse_ds64. (CVE-2024-47775) GStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776) GStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777) GStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778) Gstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834) Gstreamer NULL-pointer dereference in LRC subtitle parser. (CVE-2024-47835)

These are all security issues fixed in the gstreamer-plugins-base-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)

• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)

• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)
• CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)
• CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)
• CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)
• CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)
• CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)
• CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).

Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain integer operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-37328)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-47538)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607, CVE-2024-47835)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-47600)