Null Pointer Dereference in GStreamer Library Affecting Media Components

CVE-2024-47599

What is CVE-2024-47599?

A null pointer dereference vulnerability has been identified within the GStreamer library, specifically in the gst_jpeg_dec_negotiate function found in gstjpegdec.c. The vulnerability arises when the function fails to verify a NULL return from gst_video_decoder_set_output_state, leading to a subsequent dereference of the outstate pointer. This oversight can result in a segmentation fault, ultimately causing a Denial of Service (DoS) condition. Users are advised to upgrade to version 1.24.10 or later, where this issue has been addressed.

References