PT-2024-10373 · Gstreamer+9 · Gstreamer+9
Antonio Morales
+1
·
Published
2024-12-09
·
Updated
2025-10-07
·
CVE-2024-47542
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GStreamer versions prior to 1.24.10
Description
A null pointer dereference has been discovered in the
id3v2 read synch uint function, located in id3v2.c. If id3v2 read synch uint is called with a null work->hdr.frame data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This issue can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV).Recommendations
For versions prior to 1.24.10, update to version 1.24.10 to resolve the issue. As a temporary workaround, consider disabling the
id3v2 read synch uint function until a patch is available. Restrict access to the id3v2.c module to minimize the risk of exploitation. Avoid using the work->hdr.frame data parameter in the affected function until the issue is resolved.Exploit
Fix
DoS
Out of bounds Read
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Gstreamer
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu