OOB-write vulnerability in GST_SSA_PARSE's gst_ssa_parse_remove_override_codes function
CVE-2024-47541

7.5HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
12 December 2024

What is CVE-2024-47541?

An out-of-bounds write vulnerability has been identified within the GStreamer media handling library, specifically in the function that manages parsing and removing SubStation Alpha (SSA) style override codes. The vulnerability occurs when an incorrectly ordered input string contains a closing curly bracket before an opening one. This scenario causes the memmove() function to erroneously copy a substring, resulting in an increasingly oversized size parameter, which leads to memory being written beyond its allocated boundaries. This flaw poses significant risks, including potential memory corruption. The issue has been resolved in GStreamer version 1.24.10.

Affected Version(s)

gstreamer < 1.24.10

References

https://securitylab.github.com/advisories/GHSL-2024-228_G...
x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...
x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-2024-0023.html
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.