PT-2026-38835 · Bitnami · Jre

Publicado 2026-05-08 · Atualizado 2026-05-08

OSV

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux parse svq3 stsd data function within qtdemux.c. In the FOURCC SMI case, seqh size is read from the input file without proper validation. If seqh size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst buffer fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

Identificadores relacionados

BIT-JRE-2024-47596

Produtos afetados

Jre

Referências · 6

• https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer · Nota
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-47596 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-jre-2024-47596 · Aviso do Fabricante
• https://gstreamer.freedesktop.org/security/sa-2024-0015.html · Nota
• https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html · Nota