PT-2024-10371 · Gstreamer+10 · Gstreamer+10
Antonio Morales
+1
·
Published
2024-12-11
·
Updated
2026-05-08
·
CVE-2024-47546
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GStreamer versions prior to 1.24.10
Description
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the
extract cc from data function within qtdemux.c. In the FOURCC c708 case, the subtraction atom length - 8 may result in an underflow if atom length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g memdup2, leading to an out-of-bounds (OOB) read. This issue may allow a remote attacker to access confidential information.Recommendations
For versions prior to 1.24.10, update to version 1.24.10 to resolve the issue. As a temporary workaround, consider restricting access to the
qtdemux.c component until a patch is available. Avoid using the extract cc from data function in sensitive operations until the issue is resolved.Exploit
Fix
DoS
Out of bounds Read
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Gstreamer
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu