CVE-2024-47545
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
Résumé
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
Description d'origine
La description telle que publiée par la source (souvent en anglais).
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
Paquets affectés
Bitnami
java-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
Bitnami
java
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
Bitnami
jre
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.451"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-47545 gst-plugins-good1.0 Corrigé dans: 1.18.4-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-47545 gst-plugins-good0.10
Références
- advisory securitylab.github.com
- patch gitlab.freedesktop.org
- web gstreamer.freedesktop.org
- web lists.debian.org
- web nvd.nist.gov