GHSL-2024-242: GStreamer has an integer underflow in FOURCC_…(CVE-2024-47545)

概要

GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami java-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]

Bitnami java

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]

Bitnami jre

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2024-47545 gst-plugins-good1.0 修正版: 1.18.4-2+deb11u3
Ubuntu UBUNTU-CVE-2024-47545 gst-plugins-good0.10

概要

原文の説明

影響パッケージ

ディストリビューション別の修正状況

参照URL