GStreamer Buffer Overwrite Vulnerability
CVE-2024-47539

9.8CRITICAL

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
12 December 2024

What is CVE-2024-47539?

A vulnerability exists in the GStreamer library, specifically within the convert_to_s334_1a function located in isomp4/qtdemux.c. This flaw originates from a mismatch between the allocated memory size for the storage array and the loop condition i * 2 < ccpair_size. When ccpair_size is even, the allocated storage does not align with the expected bounds, leading to the potential for an out-of-bounds write that can overwrite memory beyond the designated limits. This issue can result in unintended behavior or crashes in applications utilizing GStreamer for media processing. An important patch has been released in version 1.24.10 to resolve this vulnerability.

Affected Version(s)

gstreamer < 1.24.10

References

https://securitylab.github.com/advisories/GHSL-2024-195_G...
x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...
x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-2024-0007.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.