{"id":"CVE-2024-47607","aliases":["ALPINE-CVE-2024-47607","ALSA-2024:11123","ALSA-2024:11345","AZL-54297","AZL-54347","AZL-62360","BELL-CVE-2024-47607","CLSA-2026-1790601978","CLSA-2026-1790603589","CLSA-2026-1790671701","CLSA-2026-1792021687","CLSA-2026-1792258320","DEBIAN-CVE-2024-47607","DLA-3999-1","DSA-5831-1","EUVD-2024-42824","OESA-2024-2563","RHSA-2024:11117","RHSA-2024:11118","RHSA-2024:11120","RHSA-2024:11123","RHSA-2024:11130","RHSA-2024:11141","RHSA-2024:11142","RHSA-2024:11143","RHSA-2024:11344","RHSA-2024:11345","RLSA-2024:11345","SUSE-SU-2025:0052-1","SUSE-SU-2025:0054-1","SUSE-SU-2025:0065-1","SUSE-SU-2025:0069-1","SUSE-SU-2025:02020-1","SUSE-SU-2025:20134-1","SUSE-SU-2025:20241-1","UBUNTU-CVE-2024-47607","USN-7175-1","USN-7807-1","openSUSE-SU-2025:14625-1"],"status":"published","title":"GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01201,"percentile":0.68427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2024-12-09T19:41:01.115114Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gst-plugins-base","fixed_in":["1.20.7-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-base1.0","fixed_in":["1.22.0-3+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-base1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-base1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.8.3-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.14.5-0ubuntu1~18.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.16.3-0ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.20.1-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.24.2-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-base","fixed_in":["1.24.11-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.4-r0"},{"fixed":"1.20.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-base-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-base-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7_9.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-base-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.3.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u3"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1","1.22.0-3+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2+deb11u3"}]}],"versions":["1.18.4-2","1.18.4-2+deb11u1","1.18.4-2+deb11u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u3"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1","1.22.0-3+deb12u2"],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-2.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-6.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-7.el9_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-3.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.el8_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-3.el7_9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.9-2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.7-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.36-2","0.10.36-2ubuntu0.1","0.10.36-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.4"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.4"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1","1.20.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.2"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1","1.24.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.4"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.4"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1","1.20.1-1ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.2"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1","1.24.2-1ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.11-1.1"}]}]}],"products":[{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0024.html","tags":["x_refsource_MISC","Release Notes","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-47607","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11123","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47538","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47607","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47615","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331727","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331740","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331754","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-11123.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11345","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-11345.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47607","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-47607","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790601978.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18297","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790603589.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790671701.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792021687.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53705","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792258320.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47615","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47607.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47607","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47835","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11117","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331754","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11117.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47538","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0022.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47607","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47615","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0026.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11118","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11118.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11120","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11120.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11130","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11130.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11141","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11141.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11142","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11142.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11143","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11143.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11344","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331760","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11344.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47537","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47537","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0005.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47540","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0017.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47606","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0014.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47613","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0025.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11345.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11345","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250052-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234415","tags":["report"]},{"url":"https://bugzilla.suse.com/1234447","tags":["report"]},{"url":"https://bugzilla.suse.com/1234450","tags":["report"]},{"url":"https://bugzilla.suse.com/1234455","tags":["report"]},{"url":"https://bugzilla.suse.com/1234456","tags":["report"]},{"url":"https://bugzilla.suse.com/1234459","tags":["report"]},{"url":"https://bugzilla.suse.com/1234460","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47835","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250054-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502020-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244403","tags":["report"]},{"url":"https://bugzilla.suse.com/1244404","tags":["report"]},{"url":"https://bugzilla.suse.com/1244407","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520134-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520241-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47607","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7175-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7807-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-37327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-37328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4453","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-47607","title":"GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:13:27.569Z","modified":"2025-11-03T22:20:20.14Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-42824","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:13:27Z","modified":"2025-11-03T22:20:20Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"nvd":[{"id":"CVE-2024-47607","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.363Z","modified":"2026-06-17T07:57:23.37Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:10:39.792395Z"}],"osv":[{"id":"ALPINE-CVE-2024-47607","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.363Z","modified":"2026-11-02T11:17:50.120162002Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-54297","title":"CVE-2024-47607 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32Z","modified":"2026-04-21T04:35:32.354261Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54347","title":"CVE-2024-47607 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-62360","title":"CVE-2024-47607 affecting package gstreamer1 1.20.0-2","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"BELL-CVE-2024-47607","status":"published","published":"2024-12-09T19:41:01.115114Z","modified":"2026-01-26T09:29:22.556341Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"CVE-2024-47607","title":"GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:13:27.569Z","modified":"2026-11-04T02:46:26.60862609Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-04T02:53:57.551196Z"},{"id":"DEBIAN-CVE-2024-47607","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:32.363Z","modified":"2026-11-02T12:02:51.422646731Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"OESA-2024-2563","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47538)\r\n\r\n(CVE-2024-47541)\r\n\r\n(CVE-2024-47542)\r\n\r\n(CVE-2024-47600)\r\n\r\n(CVE-2024-47607)\r\n\r\n(CVE-2024-47615)\r\n\r\n(CVE-2024-47835)","status":"published","published":"2024-12-20T11:08:02Z","modified":"2026-08-18T01:18:43.573340483Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:11117","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:53Z","modified":"2026-09-23T10:02:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11118","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:54Z","modified":"2026-09-23T10:02:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11120","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:55Z","modified":"2026-09-23T10:02:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11123","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:56Z","modified":"2026-09-23T10:02:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11130","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:57Z","modified":"2026-09-23T10:02:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11141","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:57Z","modified":"2026-09-23T10:02:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11142","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:58Z","modified":"2026-09-23T10:02:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11143","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-18T10:05:58Z","modified":"2026-09-23T10:02:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11344","title":"Red Hat Security Advisory: gstreamer1-plugins-base and gstreamer1-plugins-good security update","status":"published","published":"2024-12-19T10:02:52Z","modified":"2026-09-23T10:02:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11345","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2024-12-19T10:02:52Z","modified":"2026-09-23T10:02:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-47607","description":"GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-10-08T12:52:29.116501046Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2024:11123","title":"Important: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)\n  * gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)\n  * gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-10-29T11:32:00.014836134Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:11345","title":"Important: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)\n  * gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)\n  * gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-10-29T11:02:26.392548627Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1790601978","title":"gstreamer1-plugins-base: Fix of CVE-2026-18297","description":"- rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports\n  as Patch1001-Patch1005\n- drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies\n- CVE-2024-47615: carry the two halves of our backport the vendor omits. Its\n  Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but\n  leaves the function declared void, so the five `return -1` statements it\n  writes are discarded and is_header_vorbis() still reports a malformed vorbis\n  setup packet as a valid header; and it guards only against underrunning the\n  ogg packet, where ours also stopped both advance loops from running past\n  op-\u003epacket + op-\u003ebytes\n- CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's\n  pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy\n  n_channels entries - up to 255 from the Opus ID header - into the 64-entry\n  dec-\u003eopus_pos; take upstream 178ae5ac, which drops the positions above 64\n  channels\n- 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference\n  in the vendor's commit message; it is taken as a hardening change, with\n  upstream 3d7a5666 on top so its overflow guard stops overflowing itself","status":"published","published":"2026-10-25T22:42:18Z","modified":"2026-10-26T09:43:19.470924773Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790603589","title":"gstreamer1-plugins-base: Fix of CVE-2026-18297","description":"- rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports\n  as Patch1001-Patch1005\n- drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies\n- CVE-2024-47615: carry the two halves of our backport the vendor omits. Its\n  Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but\n  leaves the function declared void, so the five `return -1` statements it\n  writes are discarded and is_header_vorbis() still reports a malformed vorbis\n  setup packet as a valid header; and it guards only against underrunning the\n  ogg packet, where ours also stopped both advance loops from running past\n  op-\u003epacket + op-\u003ebytes\n- CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's\n  pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy\n  n_channels entries - up to 255 from the Opus ID header - into the 64-entry\n  dec-\u003eopus_pos; take upstream 178ae5ac, which drops the positions above 64\n  channels\n- 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference\n  in the vendor's commit message; it is taken as a hardening change, with\n  upstream 3d7a5666 on top so its overflow guard stops overflowing itself","status":"published","published":"2026-10-23T01:48:24Z","modified":"2026-10-26T09:43:23.01711343Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790671701","title":"gstreamer1-plugins-good: Fix of 5 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-09-29T08:48:29Z","modified":"2026-10-26T09:43:38.446466432Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792021687","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-10-17T13:05:05Z","modified":"2026-10-26T09:43:54.479409394Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792258320","title":"gstreamer1-plugins-base: Fix of 2 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports\n  as Patch1001-Patch1005\n- drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies\n- CVE-2024-47615: carry the two halves of our backport the vendor omits. Its\n  Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but\n  leaves the function declared void, so the five `return -1` statements it\n  writes are discarded and is_header_vorbis() still reports a malformed vorbis\n  setup packet as a valid header; and it guards only against underrunning the\n  ogg packet, where ours also stopped both advance loops from running past\n  op-\u003epacket + op-\u003ebytes\n- CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's\n  pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy\n  n_channels entries - up to 255 from the Opus ID header - into the 64-entry\n  dec-\u003eopus_pos; take upstream 178ae5ac, which drops the positions above 64\n  channels\n- 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference\n  in the vendor's commit message; it is taken as a hardening change, with\n  upstream 3d7a5666 on top so its overflow guard stops overflowing itself","status":"published","published":"2026-10-20T01:45:19Z","modified":"2026-10-26T09:43:22.056077227Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"DLA-3999-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-12-21T00:00:00Z","modified":"2026-03-09T01:21:57.213125Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5831-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-12-14T00:00:00Z","modified":"2026-03-09T02:08:35.47239Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2025:14625-1","title":"gstreamer-plugins-base-1.24.11-1.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-base-1.24.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-09T00:00:00Z","modified":"2026-02-04T04:15:31.726788Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:11345","title":"Important: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)\n\n* gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)\n\n* gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-12-19T04:18:05.672002Z","modified":"2026-02-05T07:30:10.578421Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2025:0052-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-09T16:35:38Z","modified":"2026-02-04T02:20:32.129654Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0054-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-09T16:36:41Z","modified":"2025-05-02T04:37:09.629011Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0065-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-10T14:42:36Z","modified":"2026-02-04T03:26:25.773005Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0069-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-10T16:52:16Z","modified":"2026-02-04T03:42:31.201739Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02020-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)\n- CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)\n- CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)\n- CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)\n- CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)\n- CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)\n- CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)\n","status":"published","published":"2025-06-19T08:35:03Z","modified":"2026-03-23T04:46:25.513506Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20134-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).\n- CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).\n- CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).\n- CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).\n","status":"published","published":"2025-03-05T16:07:27Z","modified":"2026-03-23T04:48:10.616716Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20241-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).\n- CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).\n- CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).\n- CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).\n","status":"published","published":"2025-03-20T10:57:31Z","modified":"2026-03-23T04:48:54.560965Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7175-1","title":"gst-plugins-base1.0 vulnerabilities","description":"Antonio Morales discovered that GStreamer Base Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Base Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2024-12-18T13:24:08Z","modified":"2026-04-27T17:39:37.390432Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7807-1","title":"gst-plugins-base1.0 vulnerabilities","description":"Michael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain integer operations. An attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)\n\nMichael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2023-37328)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2024-47538)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,\nCVE-2024-47835)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-47600)","status":"published","published":"2025-10-07T03:19:35Z","modified":"2026-06-25T13:32:31.231904971Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}