CVE-2024-47600

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.

Security Fix(es):

(CVE-2024-47538)

(CVE-2024-47541)

(CVE-2024-47542)

(CVE-2024-47600)

(CVE-2024-47607)

(CVE-2024-47615)

(CVE-2024-47835)

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)

• gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)

• gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)

• gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)
• gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)
• gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)
• gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

• CVE-2024-47600: fixed out-of-bounds read in the gst-discoverer-1.0 command-line tool that could cause crashes

GStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537) GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet. (CVE-2024-47538) GStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539) GStreamer uses uninitialized stack memory in Matroska/WebM demuxer. (CVE-2024-47540) GStreamer has an out-of-bounds write in SSA subtitle parser. (CVE-2024-47541) GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference. (CVE-2024-47542) GStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543) GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (CVE-2024-47544) GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read. (CVE-2024-47545) GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read. (CVE-2024-47546) GStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596) GStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597) GStreamer has an OOB-read in qtdemux_merge_sample_table. (CVE-2024-47598) GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (CVE-2024-47599) GStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600) GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47601) GStreamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (CVE-2024-47602) GStreamer NULL-pointer dereference in Matroska/WebM demuxer. (CVE-2024-47603) GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (CVE-2024-47606) Stack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607) GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush. (CVE-2024-47613) GStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615) GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk. (CVE-2024-47774) GStreamer has an OOB-read in parse_ds64. (CVE-2024-47775) GStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776) GStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777) GStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778) Gstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834) Gstreamer NULL-pointer dereference in LRC subtitle parser. (CVE-2024-47835)

These are all security issues fixed in the gstreamer-plugins-base-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)
• CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)
• CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)
• CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)
• CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)
• CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)
• CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).

Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain integer operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-37328)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-47538)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607, CVE-2024-47835)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-47600)