{"id":"CVE-2024-47606","aliases":["ALPINE-CVE-2024-47606","ALSA-2024:11122","ALSA-2024:11299","AZL-62366","BIT-java-2024-47606","BIT-java-min-2024-47606","BIT-jre-2024-47606","CLSA-2025-1764322066","CLSA-2025-1764325574","CLSA-2025-1764598717","CLSA-2025-1764774571","CLSA-2026-1776433691","CLSA-2026-1790671701","CLSA-2026-1792021687","CLSA-2026-1792539934","DEBIAN-CVE-2024-47606","DLA-3994-1","DLA-4071-1","DSA-5832-1","DSA-5838-1","EUVD-2024-42823","OESA-2024-2592","OESA-2024-2593","OESA-2024-2594","OESA-2024-2595","OESA-2024-2596","OESA-2025-2435","OESA-2025-2436","OESA-2025-2437","OESA-2025-2438","OESA-2025-2439","OESA-2025-2440","RHSA-2024:11119","RHSA-2024:11121","RHSA-2024:11122","RHSA-2024:11148","RHSA-2024:11149","RHSA-2024:11298","RHSA-2024:11299","RHSA-2024:11344","RHSA-2024:11346","RHSA-2024:11348","RLSA-2024:11122","RLSA-2024:11299","SUSE-SU-2025:00063-1","SUSE-SU-2025:0051-1","SUSE-SU-2025:0053-1","SUSE-SU-2025:0055-1","SUSE-SU-2025:0062-1","SUSE-SU-2025:0063-1","SUSE-SU-2025:0064-1","SUSE-SU-2025:0067-1","SUSE-SU-2025:0070-1","SUSE-SU-2025:02034-1","SUSE-SU-2025:02055-1","SUSE-SU-2025:20240-1","SUSE-SU-2025:20693-1","UBUNTU-CVE-2024-47606","USN-7174-1","USN-7176-1","openSUSE-SU-2024:14576-1","openSUSE-SU-2024:14578-1"],"status":"published","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01728,"percentile":0.77766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-191"],"published":"2024-12-11T19:12:40Z","modified":"2026-11-11T09:38:29Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-good","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.8.0","8.0.451"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-devel","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-devel-docs","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"gstreamer1","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-devel","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-devel-docs","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1","fixed_in":["1.18.4-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-devel","fixed_in":["1.18.4-4.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1","fixed_in":["1.22.12-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-devel","fixed_in":["1.22.12-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gstreamer1","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-devel","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-devel-docs","fixed_in":["1.10.4-2.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-good1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gstreamer1.0","fixed_in":["1.22.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gstreamer1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gstreamer1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"gstreamer1.0","fixed_in":["1.18.4-2.1+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1","fixed_in":["1.16.2-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1","fixed_in":["1.19.3-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1","fixed_in":["1.19.3-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"gstreamer1","fixed_in":["1.22.5-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1","fixed_in":["1.22.5-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"gstreamer1","fixed_in":["1.22.5-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer","fixed_in":["1.8.3-10.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer","fixed_in":["1.8.3-10.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer","fixed_in":["1.22.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer","fixed_in":["1.22.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer","fixed_in":["1.22.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer","fixed_in":["1.22.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer","fixed_in":["1.22.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gstreamer","fixed_in":["1.24.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer","fixed_in":["1.20.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer","fixed_in":["1.16.3-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer","fixed_in":["1.16.3-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer","fixed_in":["1.16.3-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer","fixed_in":["1.16.3-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer","fixed_in":["1.16.3-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gstreamer","fixed_in":["1.24.7-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer","fixed_in":["1.22.9-2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.16.3-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gstreamer1.0","fixed_in":["1.16.3-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.20.3-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gstreamer1.0","fixed_in":["1.20.3-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.24.2-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gstreamer1.0","fixed_in":["1.24.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gstreamer","fixed_in":["1.24.10-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-4.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7_9.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u2"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-2+deb12u1"}]}],"versions":["1.22.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2.1+deb11u1"}]}],"versions":["1.18.4-2.1"]},{"source":"osv","ecosystem":"Debian:11","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2+deb11u3"}]}],"versions":["1.18.4-2","1.18.4-2+deb11u1","1.18.4-2+deb11u2"],"bundled":22},{"source":"osv","ecosystem":"Debian:12","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-2+deb12u1"}]}],"versions":["1.22.0-2"]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u2"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1"],"bundled":22},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp4"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp3"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2003sp4"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-8.oe2203sp1"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-4.oe2403"}]}],"bundled":22},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.3-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.3-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-6.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-10.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-10.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.3.17.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.7-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.9-2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gstreamer0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.36-1.2ubuntu1","0.10.36-1.2ubuntu2","0.10.36-1.2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3","1.8.3-1ubuntu0.5+esm4","1.8.3-1ubuntu0.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.6.1-1","1.6.2-1","1.7.1-1","1.7.2-1","1.7.90-1","1.7.91-1","1.8.0-1","1.8.1-1~ubuntu1","1.8.2-1~ubuntu1","1.8.3-1~ubuntu0.1","1.8.3-1~ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-good0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.31-3+nmu4ubuntu2~gcc5.1","0.10.31-3+nmu4ubuntu2.16.04.1","0.10.31-3+nmu4ubuntu2.16.04.2","0.10.31-3+nmu4ubuntu2.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gstreamer0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.36-1.5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3","1.14.5-0ubuntu1~18.04.3+esm4","1.14.5-0ubuntu1~18.04.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1","1.13.91-1","1.14.0-1","1.14.1-1~ubuntu18.04.1","1.14.1-1~ubuntu18.04.2","1.14.4-1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.2"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.3"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.1"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.1-1","1.20.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.1"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.1"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.2"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.1"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.1-1","1.20.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.1"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.3"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.1"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1"],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-2.1"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0014.html","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html","tags":["Mailing List","discussion","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250418-0003/","tags":["web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-47606","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11122","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47537","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47539","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47606","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47613","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331719","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331722","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331726","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331753","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331760","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-11122.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11299","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-11299.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2025-1764322066.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2025-1764325574.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1764598717.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764774571.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776433691.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790671701.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792021687.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53705","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792539934.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47606.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47606","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2592","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47834","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2593","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2594","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2595","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47598","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2435","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2436","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2437","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2438","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2439","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2440","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11119","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331760","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11119.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47537","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0005.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47539","tags":["advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0007.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47540","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0017.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47606","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47613","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0025.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11121","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11121.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11122.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11148","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11148.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11149","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11149.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11298","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11298.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11299.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11344","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331754","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11344.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47538","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0022.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47607","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0024.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47615","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0026.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11346","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11346.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11348","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11348.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11122","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11299","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202500063-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234414","tags":["report"]},{"url":"https://bugzilla.suse.com/1234421","tags":["report"]},{"url":"https://bugzilla.suse.com/1234424","tags":["report"]},{"url":"https://bugzilla.suse.com/1234425","tags":["report"]},{"url":"https://bugzilla.suse.com/1234427","tags":["report"]},{"url":"https://bugzilla.suse.com/1234428","tags":["report"]},{"url":"https://bugzilla.suse.com/1234432","tags":["report"]},{"url":"https://bugzilla.suse.com/1234433","tags":["report"]},{"url":"https://bugzilla.suse.com/1234434","tags":["report"]},{"url":"https://bugzilla.suse.com/1234435","tags":["report"]},{"url":"https://bugzilla.suse.com/1234436","tags":["report"]},{"url":"https://bugzilla.suse.com/1234439","tags":["report"]},{"url":"https://bugzilla.suse.com/1234440","tags":["report"]},{"url":"https://bugzilla.suse.com/1234446","tags":["report"]},{"url":"https://bugzilla.suse.com/1234447","tags":["report"]},{"url":"https://bugzilla.suse.com/1234449","tags":["report"]},{"url":"https://bugzilla.suse.com/1234462","tags":["report"]},{"url":"https://bugzilla.suse.com/1234473","tags":["report"]},{"url":"https://bugzilla.suse.com/1234476","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47834","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250051-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250053-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250055-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234417","tags":["report"]},{"url":"https://bugzilla.suse.com/1234426","tags":["report"]},{"url":"https://bugzilla.suse.com/1234477","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250062-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250063-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250064-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250067-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250070-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502034-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502055-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520240-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520693-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47606","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7174-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7176-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47834","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WXI5GJB5BPV65JTOGBHL6STLB5HKYOIT/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GZDF3P2GSSY47IWYHI5OBEEMZAKWSY3E/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47530","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-47606","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:12:40.186Z","modified":"2026-11-04T00:04:21.521Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-04T00:47:47.540303Z"}],"euvd":[{"id":"EUVD-2024-42823","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:12:40Z","modified":"2026-11-04T00:04:21Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-04T01:51:27.299093Z"}],"nvd":[{"id":"CVE-2024-47606","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.22Z","modified":"2026-11-03T22:17:24.583Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-190","CWE-191"],"updated_at":"2026-11-04T00:47:54.173626Z"}],"osv":[{"id":"ALPINE-CVE-2024-47606","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.22Z","modified":"2026-11-03T06:32:50.106815643Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"AZL-62366","title":"CVE-2024-47606 affecting package gstreamer1 1.20.0-2","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CVE-2024-47606","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:12:40.186Z","modified":"2026-11-05T02:31:11.153936624Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T03:07:54.27622Z"},{"id":"DEBIAN-CVE-2024-47606","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.22Z","modified":"2026-11-04T09:47:33.166138647Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T10:05:32.187009Z"},{"id":"OESA-2024-2592","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.558690483Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2593","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.681563335Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2594","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:43.698068836Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2595","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:04Z","modified":"2026-08-18T01:18:44.221783336Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2596","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47537)\r\n\r\n(CVE-2024-47539)\r\n\r\n(CVE-2024-47540)\r\n\r\n(CVE-2024-47543)\r\n\r\n(CVE-2024-47544)\r\n\r\n(CVE-2024-47545)\r\n\r\n(CVE-2024-47546)\r\n\r\n(CVE-2024-47596)\r\n\r\n(CVE-2024-47597)\r\n\r\n(CVE-2024-47598)\r\n\r\n(CVE-2024-47599)\r\n\r\n(CVE-2024-47601)\r\n\r\n(CVE-2024-47602)\r\n\r\n(CVE-2024-47603)\r\n\r\n(CVE-2024-47606)\r\n\r\n(CVE-2024-47613)\r\n\r\n(CVE-2024-47774)\r\n\r\n(CVE-2024-47775)\r\n\r\n(CVE-2024-47776)\r\n\r\n(CVE-2024-47777)\r\n\r\n(CVE-2024-47778)\r\n\r\n(CVE-2024-47834)","status":"published","published":"2024-12-27T11:08:05Z","modified":"2026-08-18T01:18:44.37521358Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-2435","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:13.98363606Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2436","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:14.820505451Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2437","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:14.415982185Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2438","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:14.408914567Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2439","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:13.844977752Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2440","title":"gstreamer1 security update","description":"GStreamer1 implements a framework that allows for processing and encoding of multimedia sources in a manner similar to a shell pipeline.\r\n\r\nSecurity Fix(es):\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the \u0026apos;slice_size\u0026apos; variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u0026gt;allocator-\u0026gt;mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.(CVE-2024-47606)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:14.412491515Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2024:11119","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-18T10:05:54Z","modified":"2026-06-30T10:06:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11121","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-18T10:05:55Z","modified":"2026-06-30T10:06:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11122","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-18T10:05:56Z","modified":"2026-06-30T10:06:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11148","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:37Z","modified":"2026-06-30T10:06:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11149","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:38Z","modified":"2026-06-30T10:06:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11298","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-18T10:06:10Z","modified":"2026-06-30T10:06:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11299","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-18T10:06:11Z","modified":"2026-06-30T10:06:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11344","title":"Red Hat Security Advisory: gstreamer1-plugins-base and gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:52Z","modified":"2026-09-23T10:02:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11346","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:53Z","modified":"2026-06-30T10:06:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11348","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:53Z","modified":"2026-06-30T10:06:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-47606","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-11-11T09:38:29.603876482Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-11T10:00:12.433451Z"},{"id":"ALSA-2024:11122","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)\n  * gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)\n  * gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)\n  * gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)\n  * gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-10-29T11:31:32.523351959Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:11299","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)\n  * gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)\n  * gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)\n  * gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)\n  * gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-10-29T11:02:26.361849536Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-java-2024-47606","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-06T14:45:01.107Z","modified":"2026-09-10T16:01:22.838349676Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2024-47606","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-06T14:45:03.512Z","modified":"2026-09-10T16:01:22.416991096Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2024-47606","title":"GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","status":"published","published":"2026-05-08T05:46:38.657Z","modified":"2026-09-10T16:01:40.703096107Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"CLSA-2025-1764322066","title":"gstreamer1: Fix of CVE-2024-47606","description":"- CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem\n- Fix documentation build with the newer gtk-doc","status":"published","published":"2025-11-28T09:27:50Z","modified":"2026-06-01T00:33:14.186888324Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1764325574","title":"gstreamer1-plugins-good: Fix of CVE-2024-47606","description":"- CVE-2024-47606: qtdemux: avoid integer overflow when parsing Theora\n  extension\n- Fix documentation build with the newer gtk-doc","status":"published","published":"2025-11-28T10:26:17Z","modified":"2026-06-01T00:33:14.108832762Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1764598717","title":"gstreamer1: Fix of CVE-2024-47606","description":"- CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem\n- Fix documentation build with the newer gtk-doc","status":"published","published":"2025-12-01T14:32:32Z","modified":"2026-06-01T00:33:08.250866052Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1764774571","title":"gstreamer1: Fix of CVE-2024-47606","description":"- CVE-2024-47606: fix integer overflow when allocating sysmem and avoid integer overflow\n  in qtdemux theora extension parsing","status":"published","published":"2025-12-03T15:09:35Z","modified":"2026-06-01T00:31:29.743368409Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1776433691","title":"gstreamer1: Fix of CVE-2024-47606","description":"- CVE-2024-47606: fix integer overflow when allocating sysmem","status":"published","published":"2026-04-17T13:48:15Z","modified":"2026-06-01T00:32:48.365396692Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1790671701","title":"gstreamer1-plugins-good: Fix of 5 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-09-29T08:48:29Z","modified":"2026-10-26T09:43:38.446466432Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792021687","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-10-17T13:05:05Z","modified":"2026-10-26T09:43:54.479409394Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792539934","title":"gstreamer1: Fix of CVE-2024-47606","description":"- CVE-2024-47606: allocator: avoid integer overflow when allocating sysmem\n- Fix documentation build with the newer gtk-doc","status":"published","published":"2026-10-20T23:45:43Z","modified":"2026-10-26T09:31:46.70185561Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"DLA-3994-1","title":"gstreamer1.0 - security update","status":"published","published":"2024-12-15T00:00:00Z","modified":"2026-03-09T01:18:25.383676Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4071-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2025-02-27T00:00:00Z","modified":"2026-03-09T01:20:02.782835Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5832-1","title":"gstreamer1.0 - security update","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-03-09T02:09:26.02504Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5838-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2024-12-29T00:00:00Z","modified":"2026-03-09T02:08:56.845652Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:14576-1","title":"gstreamer-1.24.10-2.1 on GA media","description":"These are all security issues fixed in the gstreamer-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-13T00:00:00Z","modified":"2026-02-04T03:30:45.033333Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14578-1","title":"gstreamer-plugins-good-1.24.10-2.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-good-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-13T00:00:00Z","modified":"2025-05-07T18:16:18.718254Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:11122","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)\n\n* gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)\n\n* gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)\n\n* gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)\n\n* gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-05T04:45:07.576405Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:11299","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)\n\n* gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)\n\n* gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)\n\n* gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)\n\n* gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-12-19T04:18:05.672002Z","modified":"2026-02-04T09:30:10.563183Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2025:00063-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)\n- CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)\n- CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)\n- CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)\n- CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. (boo#1234476)\n- CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424)\n- CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)\n- CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427)\n- CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)\n- CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. (boo#1234432)\n- CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)\n- CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. (boo#1234446)\n- CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)\n- CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)\n- CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)\n- CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)\n- CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files. (boo#1234440)\n","status":"published","published":"2025-06-24T12:03:30Z","modified":"2026-03-23T04:46:14.684621Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0051-1","title":"Security update for gstreamer","description":"This update for gstreamer fixes the following issues:\n\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n","status":"published","published":"2025-01-09T16:35:23Z","modified":"2026-02-04T04:34:20.356832Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0053-1","title":"Security update for gstreamer","description":"This update for gstreamer fixes the following issues:\n\n- CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449)\n","status":"published","published":"2025-01-09T16:36:08Z","modified":"2026-02-04T02:21:30.152036Z","updated_at":"2026-11-02T15:53:56.123059Z"}]},"sources_more":{"osv":12}}