Skip to content
OpenAdvisories
High ALAS2-2024-2454 1 CVE

Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2)

Published Feb 15, 2024 · Updated Feb 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0444: GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE: https://gstreamer.freedesktop.org/security/sa-2024-0001.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5970 NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/394d5066f8a7b728df02fe9084e955b2f7d7f6fe (1.22.9) ADVISORIES: ['DSA-5608-1']

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 gstreamer1-plugins-bad-free 0:1.18.4-5.amzn2.0.4
Amazon Linux · 2 gstreamer1-plugins-bad-free-debuginfo 0:1.18.4-5.amzn2.0.4
Amazon Linux · 2 gstreamer1-plugins-bad-free-devel 0:1.18.4-5.amzn2.0.4

Vulnerabilities 1

  • High 7.5
    CVE-2024-0444

    GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

    GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this…

    GStreamer GStreamer gst-plugins-bad1.0 gst-plugins-bad1.0 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-0444.html