Skip to content
OpenAdvisories
Medium ALAS2-2025-2964 18 CVEs

Moderate: gstreamer1-plugins-good security update (Amazon Linux 2)

Published Aug 5, 2025 · Updated Aug 19, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47834: GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10. CVE-2024-47778: GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10. CVE-2024-47777: GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10. CVE-2024-47776: GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10. CVE-2024-47775: GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multiple GST_READ_UINT32_LE operations without performing boundary checks. This can lead to an OOB-read when buf is smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10. CVE-2024-47774: GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10. CVE-2024-47603: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values. If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10. CVE-2024-47602: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10. CVE-2024-47601: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10. CVE-2024-47599: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 gstreamer1-plugins-good 0:1.18.4-6.amzn2.0.7
Amazon Linux · 2 gstreamer1-plugins-good-debuginfo 0:1.18.4-6.amzn2.0.7
Amazon Linux · 2 gstreamer1-plugins-good-gtk 0:1.18.4-6.amzn2.0.7

Vulnerabilities 18

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-3498.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47539.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47543.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47545.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47546.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47596.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47597.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47598.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47599.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47601.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47602.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47603.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47774.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47775.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47776.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47777.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47778.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47834.html