Skip to content
OpenAdvisories
Medium ALAS2-2025-3003 3 CVEs

Moderate: gstreamer1-plugins-good security update (Amazon Linux 2)

Published Sep 10, 2025 · Updated Sep 16, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-47219: In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure. CVE-2025-47183: In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure. CVE-2024-47544: GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 gstreamer1-plugins-good 0:1.18.4-6.amzn2.0.8
Amazon Linux · 2 gstreamer1-plugins-good-debuginfo 0:1.18.4-6.amzn2.0.8
Amazon Linux · 2 gstreamer1-plugins-good-gtk 0:1.18.4-6.amzn2.0.8

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47544.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-47183.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-47219.html