GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush

CVE-2024-47613

What is CVE-2024-47613?

A vulnerability in the GStreamer media library has been identified, specifically in the gst_gdk_pixbuf_dec_flush function located within gstgdkpixbufdec.c. This vulnerability arises from a null pointer dereference issue caused by the function's reliance on out_pix pointing to a valid frame structure read from the input file. Under certain conditions, out_pix may reference a NULL frame, leading to a critical situation when memcpy attempts to write to this null address (0x00). The outcome of this flaw can cause a Denial of Service (DoS), resulting in a segmentation fault, which could lead to service disruptions for applications relying on the GStreamer library. Users of affected versions are encouraged to update to version 1.24.10 or later, where this vulnerability has been addressed.

References