CVE-2024-47607

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.

Security Fix(es):

(CVE-2024-47538)

(CVE-2024-47541)

(CVE-2024-47542)

(CVE-2024-47600)

(CVE-2024-47607)

(CVE-2024-47615)

(CVE-2024-47835)

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports as Patch1001-Patch1005
• drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies
• CVE-2024-47615: carry the two halves of our backport the vendor omits. Its Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but leaves the function declared void, so the five return -1 statements it writes are discarded and is_header_vorbis() still reports a malformed vorbis setup packet as a valid header; and it guards only against underrunning the ogg packet, where ours also stopped both advance loops from running past op->packet + op->bytes
• CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy n_channels entries - up to 255 from the Opus ID header - into the 64-entry dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64 channels
• 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference in the vendor's commit message; it is taken as a hardening change, with upstream 3d7a5666 on top so its overflow guard stops overflowing itself

• rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports as Patch1001-Patch1005
• drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies
• CVE-2024-47615: carry the two halves of our backport the vendor omits. Its Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but leaves the function declared void, so the five return -1 statements it writes are discarded and is_header_vorbis() still reports a malformed vorbis setup packet as a valid header; and it guards only against underrunning the ogg packet, where ours also stopped both advance loops from running past op->packet + op->bytes
• CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy n_channels entries - up to 255 from the Opus ID header - into the 64-entry dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64 channels
• 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference in the vendor's commit message; it is taken as a hardening change, with upstream 3d7a5666 on top so its overflow guard stops overflowing itself

• rebase onto Oracle 1.10.4-2.0.5.el7_9
• the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is CVE-2024-47606 and is what this package needs
• drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches
• CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's Patch1007 protects the dec_data allocation but leaves the output-buffer size computed in 32-bit arithmetic on this branch, because upstream's fix relies on a gsize refactor 1.10.4 does not have
• restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska track gets malformed codec_data
• keep BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy and which would split the generated documentation between architectures
• require gstreamer1-plugins-base >= 1.10.4-2.0.3, the first of our builds in which gst_video_info_set_format() returns the gboolean the vendor's Patch1004 tests

• rebase onto Oracle 1.10.4-2.0.5.el7_9
• the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is CVE-2024-47606 and is what this package needs
• drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches
• CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's Patch1007 protects the dec_data allocation but leaves the output-buffer size computed in 32-bit arithmetic on this branch, because upstream's fix relies on a gsize refactor 1.10.4 does not have
• restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska track gets malformed codec_data
• keep BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy and which would split the generated documentation between architectures
• require gstreamer1-plugins-base >= 1.10.4-2.0.3, the first of our builds in which gst_video_info_set_format() returns the gboolean the vendor's Patch1004 tests

• rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports as Patch1001-Patch1005
• drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies
• CVE-2024-47615: carry the two halves of our backport the vendor omits. Its Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but leaves the function declared void, so the five return -1 statements it writes are discarded and is_header_vorbis() still reports a malformed vorbis setup packet as a valid header; and it guards only against underrunning the ogg packet, where ours also stopped both advance loops from running past op->packet + op->bytes
• CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy n_channels entries - up to 255 from the Opus ID header - into the 64-entry dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64 channels
• 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference in the vendor's commit message; it is taken as a hardening change, with upstream 3d7a5666 on top so its overflow guard stops overflowing itself

These are all security issues fixed in the gstreamer-plugins-base-1.24.11-1.1 package on the GA media of openSUSE Tumbleweed.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

• gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)

• gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)

• gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
• CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
• CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
• CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
• CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
• CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
• CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)
• CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)
• CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)
• CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)
• CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)
• CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)
• CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).

This update for gstreamer-plugins-base fixes the following issues:

• CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).
• CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).
• CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).
• CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).
• CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).
• CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).
• CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).

Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain integer operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)

Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-37328)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-47538)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607, CVE-2024-47835)

Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs, which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-47600)