PT-2024-9621 · Gstreamer+10 · Gstreamer+10
Antonio Morales
+1
·
Published
2024-09-27
·
Updated
2025-05-14
·
CVE-2024-47598
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
GStreamer versions prior to 1.24.10
Description
A vulnerability has been discovered in the qtdemux merge sample table function within qtdemux.c, which is part of the GStreamer library. This issue is related to an out-of-bounds (OOB) read in memory. The problem arises because the size of the stts buffer is not properly checked before reading stts duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker.
Recommendations
For versions prior to 1.24.10, update to version 1.24.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the qtdemux merge sample table function until a patch is applied. Avoid using the
stts duration variable in the affected function until the issue is resolved.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Gstreamer
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu