CVE-2024-47607
GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header
Résumé
GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header
Description d'origine
La description telle que publiée par la source (souvent en anglais).
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2024-47607 gst-plugins-base Corrigé dans: 1.24.10-r0
- Debian DEBIAN-CVE-2024-47607 gst-plugins-base1.0 Corrigé dans: 1.18.4-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-47607 gst-plugins-base0.10
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch gitlab.freedesktop.org
- web gstreamer.freedesktop.org
- web lists.debian.org