PT-2024-9613 · Gstreamer+9 · Gstreamer+9
Antonio Morales
+1
·
Published
2024-09-30
·
Updated
2025-10-07
·
CVE-2024-47541
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
GStreamer versions prior to 1.24.10
Description
The issue is related to an out-of-bounds write vulnerability in the
gst ssa parse remove override codes function, which is responsible for parsing and removing SSA style override codes. This vulnerability can be exploited by a remote attacker to cause a denial of service. The problem occurs when a closing curly bracket "}" appears before an opening curly bracket "{" in the input string, causing memmove() to incorrectly duplicate a substring and leading to a write beyond the allocated memory bounds.Recommendations
For versions prior to 1.24.10, update to version 1.24.10 or later to fix the vulnerability. As a temporary workaround, consider restricting the input to the
gst ssa parse remove override codes function to prevent the out-of-bounds write. Avoid using the gst ssa parse remove override codes function with untrusted input until the issue is resolved.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Gstreamer
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu