CVE-2024-47545
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
Summary
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
Original description
The description as published by the source.
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
Affected packages
Bitnami
java-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
Bitnami
java
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
Bitnami
jre
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-47545 gst-plugins-good1.0 Fixed in: 1.18.4-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-47545 gst-plugins-good0.10
References
- advisory securitylab.github.com
- patch gitlab.freedesktop.org
- web gstreamer.freedesktop.org
- web lists.debian.org
- web nvd.nist.gov