{"id":"CVE-2024-47835","aliases":["ALPINE-CVE-2024-47835","ALSA-2025:7243","AZL-54303","AZL-54350","AZL-62363","BELL-CVE-2024-47835","CLSA-2025-1748639719","DEBIAN-CVE-2024-47835","DLA-3999-1","DSA-5831-1","EUVD-2024-42839","MGASA-2025-0040","OESA-2024-2563","RHSA-2025:7243","RLSA-2025:7243","SUSE-SU-2025:0052-1","SUSE-SU-2025:0054-1","SUSE-SU-2025:0065-1","SUSE-SU-2025:0069-1","SUSE-SU-2025:02020-1","SUSE-SU-2025:20134-1","SUSE-SU-2025:20241-1","UBUNTU-CVE-2024-47835","USN-7175-1","USN-7807-1","openSUSE-SU-2024:14577-1"],"status":"published","title":"GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01047,"percentile":0.64438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-12-09T19:41:47.601852Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gst-plugins-base","fixed_in":["1.20.7-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gst-plugins-base","fixed_in":["1.24.10-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base","fixed_in":["1.18.4-5.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base-devel","fixed_in":["1.18.4-5.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base-tools","fixed_in":["1.18.4-5.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-base1.0","fixed_in":["1.22.0-3+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-base1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-base1.0","fixed_in":["1.24.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.8.3-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.14.5-0ubuntu1~18.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.16.3-0ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.20.1-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.24.2-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gstreamer1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.4-r0"},{"fixed":"1.20.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.24.10-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-5.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-5.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-5.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u3"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1","1.22.0-3+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2+deb11u3"}]}],"versions":["1.18.4-2","1.18.4-2+deb11u1","1.18.4-2+deb11u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3+deb12u3"}]}],"versions":["1.22.0-3","1.22.0-3+deb12u1","1.22.0-3+deb12u2"],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.2.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-2.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-6.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-8.oe2203sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-base-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.19.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.9-2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.7-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.36-2","0.10.36-2ubuntu0.1","0.10.36-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.4"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.4"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1","1.20.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.2"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1","1.24.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.4"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4","1.16.2-4ubuntu0.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.4"}]}],"versions":["1.18.5-1","1.19.90-1","1.20.0-1","1.20.0-2","1.20.1-1","1.20.1-1ubuntu0.1","1.20.1-1ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu0.2"}]}],"versions":["1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1","1.24.2-1","1.24.2-1ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.3+esm1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.10-2.1"}]}],"bundled":5}],"products":[{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2024-263_Gstreamer/","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8039.patch","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0029.html","tags":["x_refsource_MISC","Release Notes","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-47835","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7243","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47541","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47542","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47600","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47835","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331717","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331724","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331738","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331742","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7243.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47835","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-47835","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1748639719.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47835.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47835","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0040.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33856","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/12/13/1","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00247.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00248.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00254.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7174-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7176-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47615","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331742","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7243.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47541","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0023.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-228_GStreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47542","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0008.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-235_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47600","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8034.patch","tags":["article"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0018.html","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-248_Gstreamer/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47835","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7243","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250052-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234415","tags":["report"]},{"url":"https://bugzilla.suse.com/1234447","tags":["report"]},{"url":"https://bugzilla.suse.com/1234450","tags":["report"]},{"url":"https://bugzilla.suse.com/1234455","tags":["report"]},{"url":"https://bugzilla.suse.com/1234456","tags":["report"]},{"url":"https://bugzilla.suse.com/1234459","tags":["report"]},{"url":"https://bugzilla.suse.com/1234460","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47835","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250054-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502020-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244403","tags":["report"]},{"url":"https://bugzilla.suse.com/1244404","tags":["report"]},{"url":"https://bugzilla.suse.com/1244407","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520134-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520241-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47835","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7175-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7807-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-47538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-37327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-37328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4453","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M64SNUMTNONUECANIAVBUNBV6RTL5TDY/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-47835","title":"GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:17:26.688Z","modified":"2025-11-03T22:21:51.646Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-42839","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:17:26Z","modified":"2025-11-03T22:21:51Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"nvd":[{"id":"CVE-2024-47835","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43.163Z","modified":"2026-06-17T07:57:50.503Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:39.792395Z"}],"osv":[{"id":"ALPINE-CVE-2024-47835","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43.163Z","modified":"2026-11-02T11:17:50.122039314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-54303","title":"CVE-2024-47835 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43Z","modified":"2026-04-21T04:35:32.805656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54350","title":"CVE-2024-47835 affecting package gstreamer1-plugins-base 1.20.0-3","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-62363","title":"CVE-2024-47835 affecting package gstreamer1 1.20.0-2","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"BELL-CVE-2024-47835","status":"published","published":"2024-12-09T19:41:47.601852Z","modified":"2026-01-26T09:35:19.959875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.711507Z"},{"id":"CVE-2024-47835","title":"GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-11T19:17:26.688Z","modified":"2026-11-04T02:46:28.360642927Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-04T02:53:57.551196Z"},{"id":"DEBIAN-CVE-2024-47835","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T02:03:43.163Z","modified":"2026-11-02T12:03:03.646599552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"OESA-2024-2563","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-47538)\r\n\r\n(CVE-2024-47541)\r\n\r\n(CVE-2024-47542)\r\n\r\n(CVE-2024-47600)\r\n\r\n(CVE-2024-47607)\r\n\r\n(CVE-2024-47615)\r\n\r\n(CVE-2024-47835)","status":"published","published":"2024-12-20T11:08:02Z","modified":"2026-08-18T01:18:43.573340483Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:7243","title":"Red Hat Security Advisory: gstreamer1-plugins-base security update","status":"published","published":"2025-05-13T10:05:06Z","modified":"2026-06-30T10:27:48Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7243","title":"Moderate: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)\n\n* gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)\n\n* gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)\n\n* gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:26.337229Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-47835","description":"GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-10-08T12:51:22.053899609Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"ALSA-2025:7243","title":"Moderate: gstreamer1-plugins-base security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)\n  * gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)\n  * gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)\n  * gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.542549232Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2025-1748639719","title":"gstreamer1-plugins-base: Fix of CVE-2024-47835","description":"- CVE-2024-47835: fix NULL-pointer dereference in LRC subtitle parser","status":"published","published":"2025-05-30T21:15:24Z","modified":"2026-06-01T00:30:50.470899437Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-3999-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-12-21T00:00:00Z","modified":"2026-03-09T01:21:57.213125Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5831-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2024-12-14T00:00:00Z","modified":"2026-03-09T02:08:35.47239Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0040","title":"Updated gstreamer1.0, gstreamer1.0-plugins-base \u0026 gstreamer1.0-plugins-good packages fix security vulnerabilities","description":"GStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537)\nGStreamer has a stack-buffer overflow in\nvorbis_handle_identification_packet. (CVE-2024-47538)\nGStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539)\nGStreamer uses uninitialized stack memory in Matroska/WebM demuxer.\n(CVE-2024-47540)\nGStreamer has an out-of-bounds write in SSA subtitle parser.\n(CVE-2024-47541)\nGStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference.\n(CVE-2024-47542)\nGStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543)\nGStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC\nhandling. (CVE-2024-47544)\nGStreamer has an integer underflow in FOURCC_strf parsing leading to\nOOB-read. (CVE-2024-47545)\nGStreamer has an integer underflow in extract_cc_from_data leading to\nOOB-read. (CVE-2024-47546)\nGStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596)\nGStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597)\nGStreamer has an OOB-read in qtdemux_merge_sample_table.\n(CVE-2024-47598)\nGStreamer Insufficient error handling in JPEG decoder that can lead to\nNULL-pointer dereferences. (CVE-2024-47599)\nGStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600)\nGStreamer has a NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47601)\nGStreamer NULL-pointer dereferences and out-of-bounds reads in\nMatroska/WebM demuxer. (CVE-2024-47602)\nGStreamer NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47603)\nGStreamer Integer overflows in MP4/MOV demuxer and memory allocator that\ncan lead to out-of-bounds writes. (CVE-2024-47606)\nStack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607)\nGStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush.\n(CVE-2024-47613)\nGStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615)\nGStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk.\n(CVE-2024-47774)\nGStreamer has an OOB-read in parse_ds64. (CVE-2024-47775)\nGStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776)\nGStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777)\nGStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778)\nGstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834)\nGstreamer NULL-pointer dereference in LRC subtitle parser.\n(CVE-2024-47835)\n","status":"published","published":"2025-02-06T20:01:39Z","modified":"2026-04-16T04:42:10.181370981Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14577-1","title":"gstreamer-plugins-base-1.24.10-2.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-base-1.24.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-13T00:00:00Z","modified":"2025-05-07T18:16:19.209605Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0052-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-09T16:35:38Z","modified":"2026-02-04T02:20:32.129654Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0054-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-09T16:36:41Z","modified":"2025-05-02T04:37:09.629011Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0065-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-10T14:42:36Z","modified":"2026-02-04T03:26:25.773005Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0069-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)\n- CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)\n- CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)\n- CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)\n- CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)\n- CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)\n- CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)\n","status":"published","published":"2025-01-10T16:52:16Z","modified":"2026-02-04T03:42:31.201739Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02020-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)\n- CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)\n- CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)\n- CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)\n- CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)\n- CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)\n- CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)\n","status":"published","published":"2025-06-19T08:35:03Z","modified":"2026-03-23T04:46:25.513506Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20134-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).\n- CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).\n- CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).\n- CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).\n","status":"published","published":"2025-03-05T16:07:27Z","modified":"2026-03-23T04:48:10.616716Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20241-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet (bsc#1234415).\n- CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bsc#1234450).\n- CVE-2024-47600: Fixed Out-of-bounds read in gst-discoverer-1.0 commandline tool (bsc#1234453).\n- CVE-2024-47615: Fixed Out-of-bounds write in Ogg demuxer (bsc#1234456).\n- CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bsc#1234459).\n- CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bsc#1234460).\n- CVE-2024-47607: Fixed Stack buffer-overflow in Opus decoder (bsc#1234455).\n","status":"published","published":"2025-03-20T10:57:31Z","modified":"2026-03-23T04:48:54.560965Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7175-1","title":"gst-plugins-base1.0 vulnerabilities","description":"Antonio Morales discovered that GStreamer Base Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Base Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2024-12-18T13:24:08Z","modified":"2026-04-27T17:39:37.390432Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7807-1","title":"gst-plugins-base1.0 vulnerabilities","description":"Michael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain integer operations. An attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)\n\nMichael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2023-37328)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2024-47538)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,\nCVE-2024-47835)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-47600)","status":"published","published":"2025-10-07T03:19:35Z","modified":"2026-06-25T13:32:31.231904971Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}