{"id":"CVE-2024-4453","aliases":["ALSA-2024:9056","ALSA-2025:7178","AZL-43432","AZL-45048","BELL-CVE-2024-4453","DEBIAN-CVE-2024-4453","DLA-3824-1","DSA-5702-1","EUVD-2024-44072","GHSA-wxq9-8346-gp9m","MGASA-2024-0215","OESA-2026-3966","OESA-2026-3967","OESA-2026-3968","OESA-2026-3970","OESA-2026-4019","RHSA-2024:9056","RHSA-2025:18416","RHSA-2025:7178","RLSA-2024:9056","RLSA-2025:7178","SUSE-SU-2024:1882-1","SUSE-SU-2024:1882-2","SUSE-SU-2024:1886-1","SUSE-SU-2024:1893-1","SUSE-SU-2024:1910-1","SUSE-SU-2024:1945-1","SUSE-SU-2026:23059-1","UBUNTU-CVE-2024-4453","USN-6798-1","USN-7807-1","openSUSE-SU-2024:14005-1"],"status":"published","title":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01578,"percentile":0.75665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2024-05-22T19:18:02Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base","fixed_in":["1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base-devel","fixed_in":["1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gst-plugins-base","fixed_in":["1.20.7-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gst-plugins-base","fixed_in":["1.24.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-base1.0","fixed_in":["1.22.0-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-base1.0","fixed_in":["1.24.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-base1.0","fixed_in":["1.24.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"gst-plugins-base1.0","fixed_in":["1.14.4-2+deb10u3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"gst-plugins-base1.0","fixed_in":["1.18.4-2+deb11u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-base","fixed_in":["1.22.11-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"gstreamer1-plugins-base","fixed_in":["1.22.5-7.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debuginfo","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debugsource","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-devel","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-base","fixed_in":["0:1.16.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer-plugins-base","fixed_in":["1.22.0-150500.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"gstreamer-plugins-base","fixed_in":["1.22.0-150500.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"gstreamer-plugins-base","fixed_in":["1.22.0-150500.3.8.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"gstreamer-plugins-base","fixed_in":["1.22.0-150500.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"gstreamer-plugins-base","fixed_in":["1.20.1-150400.3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-base","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer-plugins-base","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-base","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer-plugins-base","fixed_in":["1.22.9-4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.8.3-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.14.5-0ubuntu1~18.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.16.3-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.20.1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.24.2-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-rtsp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.4-r0"},{"fixed":"1.20.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.24.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u2"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-2+deb10u3"}]}],"versions":["1.14.4-2","1.14.4-2+deb10u1","1.14.4-2+deb10u2"]},{"source":"osv","ecosystem":"Debian:11","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2+deb11u2"}]}],"versions":["1.18.4-2","1.18.4-2+deb11u1"]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u2"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-13.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-12.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-7.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-ugly-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-plugins-ugly-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-rtsp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-rtsp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-rtsp-server-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhivos:1.0","package":"gstreamer1-rtsp-server-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.8.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.9-4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.36-2","0.10.36-2ubuntu0.1","0.10.36-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.2"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.1"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.2"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.1"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"],"bundled":10}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-467/","tags":["x_research-advisory","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.freedesktop.org/tpm/gstreamer/-/commit/e68eccff103ab0e91e6d77a892f57131b33902f5","tags":["vendor-advisory","x_transferred","Patch","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00019.html","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4453","tags":["web","advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-467"},{"url":"https://github.com/advisories/GHSA-wxq9-8346-gp9m"},{"url":"https://access.redhat.com/errata/RHSA-2024:9056","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4453","tags":["report"]},{"url":"https://bugzilla.redhat.com/2282999","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-9056.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0444","tags":["report"]},{"url":"https://bugzilla.redhat.com/2292335","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7178.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-4453","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4453.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-4453","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0215.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33259","tags":["report"]},{"url":"https://lwn.net/Articles/976177/","tags":["web"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0002.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85150","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3967","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3968","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3970","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4019","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2282999","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9056.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4453","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:18416","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292335","tags":["report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_in_vehicle_os/1.0/html/1.0_release_notes/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/indexhttps://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18416.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0444","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7178.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9056","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7178","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241882-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4453","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241882-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241886-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241893-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241910-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241945-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623059-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-4453","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6798-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7807-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-37328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47835","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4453","title":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T19:18:02.927Z","modified":"2025-02-13T17:53:35.191Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-44072","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T19:18:02Z","modified":"2025-02-13T17:53:35Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-wxq9-8346-gp9m","title":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This...","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T21:30:36Z","modified":"2024-06-10T18:31:03Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:57:27.150795Z"}],"nvd":[{"id":"CVE-2024-4453","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T20:15:09.923Z","modified":"2026-06-17T08:01:54.657Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"AZL-43432","title":"CVE-2024-4453 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T20:15:09Z","modified":"2026-04-21T04:30:59.907443Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45048","title":"CVE-2024-4453 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T20:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"BELL-CVE-2024-4453","status":"published","published":"2024-05-24T05:56:46.721309Z","modified":"2026-01-26T09:41:07.972017Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"CVE-2024-4453","title":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T19:18:02.927Z","modified":"2026-10-28T10:55:02.253896743Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-4453","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.  The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-23896.","status":"published","published":"2024-05-22T20:15:09.923Z","modified":"2026-11-02T12:03:14.080775718Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"OESA-2026-3966","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\n\nGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-23896.(CVE-2024-4453)\n\nA NULL pointer dereference flaw was found in GStreamer\u0026apos;s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0026apos;s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.(CVE-2026-85150)","status":"published","published":"2026-09-20T13:23:39Z","modified":"2026-09-20T13:30:31.90360059Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3967","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\n\nGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-23896.(CVE-2024-4453)\n\nA NULL pointer dereference flaw was found in GStreamer\u0026apos;s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0026apos;s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.(CVE-2026-85150)","status":"published","published":"2026-09-20T13:23:40Z","modified":"2026-09-20T13:30:31.199205104Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3968","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\n\nGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-23896.(CVE-2024-4453)\n\nA NULL pointer dereference flaw was found in GStreamer\u0026apos;s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0026apos;s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.(CVE-2026-85150)","status":"published","published":"2026-09-20T13:23:41Z","modified":"2026-09-20T13:30:31.207802372Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3970","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\n\nGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-23896.(CVE-2024-4453)\n\nA NULL pointer dereference flaw was found in GStreamer\u0026apos;s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0026apos;s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.(CVE-2026-85150)","status":"published","published":"2026-09-20T13:23:42Z","modified":"2026-09-20T13:30:29.711234594Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4019","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\n\nGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-23896.(CVE-2024-4453)","status":"published","published":"2026-09-25T01:27:22Z","modified":"2026-09-25T01:45:04.648534752Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2024:9056","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-11-12T02:28:33Z","modified":"2026-03-18T11:36:20.307104Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:18416","title":"Red Hat Security Advisory: Automotive bug fix and enhancement update","status":"published","published":"2025-10-21T10:09:46Z","modified":"2026-08-01T10:31:18.097645185Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:7178","title":"Red Hat Security Advisory: gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update","status":"published","published":"2025-05-13T10:05:04Z","modified":"2026-08-01T10:05:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7178","title":"Moderate: gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update","description":"The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. \n\nSecurity Fix(es):\n\n* gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)\n\n* gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:25.265357Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-4453","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-23896.","status":"published","published":"2024-05-23T00:00:00Z","modified":"2026-10-08T12:52:10.142191245Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2024:9056","title":"Moderate: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.  \n\nSecurity Fix(es):  \n\n  * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-10-29T11:02:22.157887154Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:7178","title":"Moderate: gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update","description":"The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data.   \n\nSecurity Fix(es):  \n\n  * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)\n  * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:31:38.464740868Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"DLA-3824-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-05-30T00:00:00Z","modified":"2026-03-09T01:22:42.239897Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5702-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-06-01T00:00:00Z","modified":"2026-03-09T02:09:10.043399Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0215","title":"Updated 0-plugins-base packages fix security vulnerability","description":"GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution\nVulnerability. This vulnerability allows remote attackers to execute\narbitrary code on affected installations of GStreamer. Interaction with\nthis library is required to exploit this vulnerability but attack\nvectors may vary depending on the implementation. The specific flaw\nexists within the parsing of EXIF metadata. The issue results from the\nlack of proper validation of user-supplied data, which can result in an\ninteger overflow before allocating a buffer. An attacker can leverage\nthis vulnerability to execute code in the context of the current\nprocess. (CVE-2024-4453)\n","status":"published","published":"2024-06-08T16:34:17Z","modified":"2026-04-16T04:40:45.60261368Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14005-1","title":"gstreamer-plugins-base-1.24.0-2.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-base-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:51.379492Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:9056","title":"Moderate: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.\n\nSecurity Fix(es):\n\n* gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-19T16:01:03.545733Z","modified":"2026-02-04T22:45:09.360803Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:1882-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-05-31T06:46:34Z","modified":"2026-02-04T02:37:28.132395Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1882-2","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-05-31T06:46:41Z","modified":"2026-02-04T04:36:31.202558Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1886-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-05-31T11:26:01Z","modified":"2026-02-04T03:12:57.194678Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1893-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-06-03T06:57:17Z","modified":"2026-02-04T02:36:03.937524Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1910-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-06-03T15:29:38Z","modified":"2026-02-04T02:54:12.954635Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1945-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-4453: Fixed lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806)\n","status":"published","published":"2024-06-07T15:05:11Z","modified":"2026-02-04T02:17:04.633941Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2026:23059-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\n\n- CVE-2024-4453: lack of proper validation of user-supplied data when parsing EXIF metadata (bsc#1224806).\n","status":"published","published":"2026-08-07T11:20:17Z","modified":"2026-08-12T18:23:41.172668841Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"USN-6798-1","title":"gst-plugins-base1.0 vulnerability","description":"It was discovered that GStreamer Base Plugins incorrectly handled certain\nEXIF metadata. An attacker could possibly use this issue to execute arbitrary\ncode or cause a crash.\n","status":"published","published":"2024-05-29T14:58:02Z","modified":"2026-04-27T17:15:43.360916Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7807-1","title":"gst-plugins-base1.0 vulnerabilities","description":"Michael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain integer operations. An attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)\n\nMichael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2023-37328)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2024-47538)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,\nCVE-2024-47835)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-47600)","status":"published","published":"2025-10-07T03:19:35Z","modified":"2026-06-25T13:32:31.231904971Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}