{"id":"CVE-2024-47597","aliases":["ALPINE-CVE-2024-47597","ALSA-2025:7242","AZL-62384","BIT-java-2024-47597","BIT-java-min-2024-47597","BIT-jre-2024-47597","DEBIAN-CVE-2024-47597","DLA-4071-1","DSA-5838-1","EUVD-2024-42816","MGASA-2025-0040","OESA-2024-2592","OESA-2024-2593","OESA-2024-2594","OESA-2024-2595","OESA-2024-2596","RHSA-2025:7242","RLSA-2025:7242","SUSE-SU-2025:00063-1","SUSE-SU-2025:0055-1","SUSE-SU-2025:0063-1","SUSE-SU-2025:0064-1","SUSE-SU-2025:0067-1","SUSE-SU-2025:02055-1","UBUNTU-CVE-2024-47597","USN-7176-1"],"status":"published","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01173,"percentile":0.67712,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-12-11T19:01:50Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-good1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.16.3-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.20.3-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.24.2-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u2"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2+deb11u3"}]}],"versions":["1.18.4-2","1.18.4-2+deb11u1","1.18.4-2+deb11u2"],"bundled":22},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u2"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1"],"bundled":22},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.2.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp4"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp3"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2003sp4"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp1"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-4.oe2403"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3","1.8.3-1ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-good0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.31-3+nmu4ubuntu2~gcc5.1","0.10.31-3+nmu4ubuntu2.16.04.1","0.10.31-3+nmu4ubuntu2.16.04.2","0.10.31-3+nmu4ubuntu2.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3","1.14.5-0ubuntu1~18.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.3"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.1"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.3"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.1"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1"],"bundled":22}],"products":[{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0012.html","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-47597","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7242","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47543","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47544","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47545","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47596","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47597","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47598","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47599","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47601","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47602","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47603","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47774","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47775","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47776","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47777","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47778","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47834","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331723","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331739","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331741","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331743","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331744","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331747","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331748","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331749","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331750","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331751","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331752","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331755","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331756","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331759","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331761","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331762","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331763","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7242.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47597","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47597.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47597","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0040.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33856","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/12/13/1","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00247.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00248.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00254.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7174-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7176-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2592","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47834","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2593","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2594","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2595","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47598","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331763","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7242.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47543","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0009.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47544","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0011.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47545","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0010.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47546","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0013.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47596","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0015.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47597","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47598","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0006.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47599","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0016.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47601","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0020.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47602","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0019.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47603","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0021.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47774","tags":["advisory"]},{"url":"https://github.com/github/securitylab-vulnerabilities/issues/1826","tags":["article"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47775","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0027.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47776","tags":["advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47777","tags":["advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47778","tags":["advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47834","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0030.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7242","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202500063-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234414","tags":["report"]},{"url":"https://bugzilla.suse.com/1234421","tags":["report"]},{"url":"https://bugzilla.suse.com/1234424","tags":["report"]},{"url":"https://bugzilla.suse.com/1234425","tags":["report"]},{"url":"https://bugzilla.suse.com/1234427","tags":["report"]},{"url":"https://bugzilla.suse.com/1234428","tags":["report"]},{"url":"https://bugzilla.suse.com/1234432","tags":["report"]},{"url":"https://bugzilla.suse.com/1234433","tags":["report"]},{"url":"https://bugzilla.suse.com/1234434","tags":["report"]},{"url":"https://bugzilla.suse.com/1234435","tags":["report"]},{"url":"https://bugzilla.suse.com/1234436","tags":["report"]},{"url":"https://bugzilla.suse.com/1234439","tags":["report"]},{"url":"https://bugzilla.suse.com/1234440","tags":["report"]},{"url":"https://bugzilla.suse.com/1234446","tags":["report"]},{"url":"https://bugzilla.suse.com/1234447","tags":["report"]},{"url":"https://bugzilla.suse.com/1234449","tags":["report"]},{"url":"https://bugzilla.suse.com/1234462","tags":["report"]},{"url":"https://bugzilla.suse.com/1234473","tags":["report"]},{"url":"https://bugzilla.suse.com/1234476","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47834","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250055-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234417","tags":["report"]},{"url":"https://bugzilla.suse.com/1234426","tags":["report"]},{"url":"https://bugzilla.suse.com/1234477","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250063-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250064-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250067-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502055-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47834","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-47597","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:01:50.82Z","modified":"2025-11-03T20:39:46.216Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-42816","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:01:50Z","modified":"2025-11-03T20:39:46Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"nvd":[{"id":"CVE-2024-47597","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:31.137Z","modified":"2026-06-17T07:57:22.207Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:10:39.792395Z"}],"osv":[{"id":"ALPINE-CVE-2024-47597","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:31.137Z","modified":"2026-11-03T06:32:09.667555773Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-62384","title":"CVE-2024-47597 affecting package gstreamer1 1.20.0-2","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:31Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CVE-2024-47597","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:01:50.82Z","modified":"2026-11-04T02:46:28.32449886Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-04T02:53:57.551196Z"},{"id":"DEBIAN-CVE-2024-47597","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:31.137Z","modified":"2026-11-02T12:03:14.057917236Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"OESA-2024-2592","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.558690483Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2593","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.681563335Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2594","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.698068836Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2595","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:44.221783336Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2596","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47598)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:05Z","modified":"2026-08-18T01:18:44.37521358Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:7242","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2025-05-13T10:05:06Z","modified":"2026-10-14T10:10:36Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7242","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)\n\n* gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)\n\n* gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)\n\n* gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)\n\n* gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599)\n\n* gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)\n\n* gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)\n\n* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)\n\n* gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)\n\n* gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602)\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)\n\n* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)\n\n* gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:26.667701Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-47597","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-10-08T12:52:28.6598774Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2025:7242","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)\n  * gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)\n  * gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)\n  * gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)\n  * gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)\n  * gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)\n  * gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599)\n  * gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)\n  * gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)\n  * gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)\n  * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)\n  * gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)\n  * gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)\n  * gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602)\n  * gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)\n  * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)\n  * gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.918071242Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"BIT-java-2024-47597","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-06T14:44:59.658Z","modified":"2026-09-10T16:01:40.248176871Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2024-47597","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-06T14:45:02.044Z","modified":"2026-09-10T16:01:22.396298582Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2024-47597","title":"GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples","description":"GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-08T05:46:37.056Z","modified":"2026-09-10T16:01:40.691615171Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"DLA-4071-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2025-02-27T00:00:00Z","modified":"2026-03-09T01:20:02.782835Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5838-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2024-12-29T00:00:00Z","modified":"2026-03-09T02:08:56.845652Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0040","title":"Updated gstreamer1.0, gstreamer1.0-plugins-base \u0026 gstreamer1.0-plugins-good packages fix security vulnerabilities","description":"GStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537)\nGStreamer has a stack-buffer overflow in\nvorbis_handle_identification_packet. (CVE-2024-47538)\nGStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539)\nGStreamer uses uninitialized stack memory in Matroska/WebM demuxer.\n(CVE-2024-47540)\nGStreamer has an out-of-bounds write in SSA subtitle parser.\n(CVE-2024-47541)\nGStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference.\n(CVE-2024-47542)\nGStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543)\nGStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC\nhandling. (CVE-2024-47544)\nGStreamer has an integer underflow in FOURCC_strf parsing leading to\nOOB-read. (CVE-2024-47545)\nGStreamer has an integer underflow in extract_cc_from_data leading to\nOOB-read. (CVE-2024-47546)\nGStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596)\nGStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597)\nGStreamer has an OOB-read in qtdemux_merge_sample_table.\n(CVE-2024-47598)\nGStreamer Insufficient error handling in JPEG decoder that can lead to\nNULL-pointer dereferences. (CVE-2024-47599)\nGStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600)\nGStreamer has a NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47601)\nGStreamer NULL-pointer dereferences and out-of-bounds reads in\nMatroska/WebM demuxer. (CVE-2024-47602)\nGStreamer NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47603)\nGStreamer Integer overflows in MP4/MOV demuxer and memory allocator that\ncan lead to out-of-bounds writes. (CVE-2024-47606)\nStack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607)\nGStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush.\n(CVE-2024-47613)\nGStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615)\nGStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk.\n(CVE-2024-47774)\nGStreamer has an OOB-read in parse_ds64. (CVE-2024-47775)\nGStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776)\nGStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777)\nGStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778)\nGstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834)\nGstreamer NULL-pointer dereference in LRC subtitle parser.\n(CVE-2024-47835)\n","status":"published","published":"2025-02-06T20:01:39Z","modified":"2026-04-16T04:42:10.181370981Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2025:00063-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n","status":"published","published":"2025-06-24T12:03:30Z","modified":"2026-03-23T04:46:14.684621Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0055-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)\n- CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)\n","status":"published","published":"2025-01-09T16:36:54Z","modified":"2026-02-04T02:31:12.776861Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0063-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n","status":"published","published":"2025-06-24T12:03:30Z","modified":"2026-02-04T09:08:22.668052Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0064-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n","status":"published","published":"2025-01-10T13:48:33Z","modified":"2026-02-04T02:49:44.502737Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0067-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. (boo#1234477)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n","status":"published","published":"2025-01-10T16:48:42Z","modified":"2026-02-04T04:26:06.660304Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02055-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47537: Fixed OOB-write in isomp4/qtdemux.c (bsc#1234414)\n- CVE-2024-47539: Fixed OOB-write in convert_to_s334_1a (bsc#1234417)\n- CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421)\n- CVE-2024-47543: Fixed OOB-read in qtdemux_parse_container (bsc#1234462)\n- CVE-2024-47544: Fixed NULL-pointer dereferences in MP4/MOV demuxer CENC handling (bsc#1234473)\n- CVE-2024-47545: Fixed integer underflow in FOURCC_strf parsing leading to OOB-read (bsc#1234476)\n- CVE-2024-47546: Fixed integer underflow in extract_cc_from_data leading to OOB-read (bsc#1234477)\n- CVE-2024-47596: Fixed integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads (bsc#1234424)\n- CVE-2024-47597: Fixed OOB-reads in MP4/MOV demuxer sample table parser (bsc#1234425)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (bsc#1234427)\n- CVE-2024-47601: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234428)\n- CVE-2024-47602: Fixed NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (bsc#1234432)\n- CVE-2024-47603: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234433)\n- CVE-2024-47606: Fixed integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (bsc#1234449)\n- CVE-2024-47613: Fixed NULL-pointer dereference in gdk-pixbuf decoder (bsc#1234447)\n- CVE-2024-47774: Fixed integer overflow in AVI subtitle parser that leads to out-of-bounds reads (bsc#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser (bsc#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser (bsc#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser (bsc#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser (bsc#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files (bsc#1234440)\n","status":"published","published":"2025-06-20T15:35:07Z","modified":"2026-02-04T02:56:01.581161Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7176-1","title":"gst-plugins-good1.0 vulnerabilities","description":"Antonio Morales discovered that GStreamer Good Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Good Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2024-12-18T13:29:45Z","modified":"2026-04-27T17:38:56.332286Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}