CVE-2024-47606

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

(CVE-2024-47537)

(CVE-2024-47539)

(CVE-2024-47540)

(CVE-2024-47543)

(CVE-2024-47544)

(CVE-2024-47545)

(CVE-2024-47546)

(CVE-2024-47596)

(CVE-2024-47597)

(CVE-2024-47598)

(CVE-2024-47599)

(CVE-2024-47601)

(CVE-2024-47602)

(CVE-2024-47603)

(CVE-2024-47606)

(CVE-2024-47613)

(CVE-2024-47774)

(CVE-2024-47775)

(CVE-2024-47776)

(CVE-2024-47777)

(CVE-2024-47778)

(CVE-2024-47834)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.

Security Fix(es):

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)
• gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)
• gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)
• gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)
• gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)
• gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)
• gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)
• gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)
• gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

• CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem
• Fix documentation build with the newer gtk-doc

• CVE-2024-47606: qtdemux: avoid integer overflow when parsing Theora extension
• Fix documentation build with the newer gtk-doc

• CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem
• Fix documentation build with the newer gtk-doc

• CVE-2024-47606: fix integer overflow when allocating sysmem and avoid integer overflow in qtdemux theora extension parsing

• CVE-2024-47606: fix integer overflow when allocating sysmem

• rebase onto Oracle 1.10.4-2.0.5.el7_9
• the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is CVE-2024-47606 and is what this package needs
• drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches
• CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's Patch1007 protects the dec_data allocation but leaves the output-buffer size computed in 32-bit arithmetic on this branch, because upstream's fix relies on a gsize refactor 1.10.4 does not have
• restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska track gets malformed codec_data
• keep BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy and which would split the generated documentation between architectures
• require gstreamer1-plugins-base >= 1.10.4-2.0.3, the first of our builds in which gst_video_info_set_format() returns the gboolean the vendor's Patch1004 tests

• rebase onto Oracle 1.10.4-2.0.5.el7_9
• the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is CVE-2024-47606 and is what this package needs
• drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches
• CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's Patch1007 protects the dec_data allocation but leaves the output-buffer size computed in 32-bit arithmetic on this branch, because upstream's fix relies on a gsize refactor 1.10.4 does not have
• restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska track gets malformed codec_data
• keep BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy and which would split the generated documentation between architectures
• require gstreamer1-plugins-base >= 1.10.4-2.0.3, the first of our builds in which gst_video_info_set_format() returns the gboolean the vendor's Patch1004 tests

• CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem
• Fix documentation build with the newer gtk-doc

These are all security issues fixed in the gstreamer-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-plugins-good-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)

• gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)

• gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)

• gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)

• gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)

• gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)

• gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)

• gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)

• gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
• CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
• CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
• CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
• CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)
• CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)
• CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
• CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)
• CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
• CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)
• CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
• CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
• CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)
• CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
• CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)
• CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
• CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
• CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
• CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
• CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)

This update for gstreamer fixes the following issues:

• CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)

This update for gstreamer fixes the following issues:

• CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)