Skip to content
OpenAdvisories
High ALSA-2024:11123 3 CVEs

Important: gstreamer1-plugins-base security update

Published Dec 16, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

* gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
* gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
* gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 9 gstreamer1-plugins-base 1.22.1-3.el9_5
AlmaLinux · 9 gstreamer1-plugins-base-devel 1.22.1-3.el9_5
AlmaLinux · 9 gstreamer1-plugins-base-tools 1.22.1-3.el9_5

Vulnerabilities 3

  • High 8.6
    CVE-2024-47538

    GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet

    GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The position array is a stack-allocated buffer of size 64. If…

    GStreamer GStreamer gstreamer1 gst-plugins-base1.0 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-47607

    GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header

    GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 6…

    GStreamer GStreamer gstreamer1 gst-plugins-base1.0 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-47615

    GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer

    GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a resul…

    GStreamer GStreamer gst-plugins-base1.0 gstreamer1 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-47538
  • report
    https://access.redhat.com/security/cve/CVE-2024-47607
  • report
    https://access.redhat.com/security/cve/CVE-2024-47615
  • report
    https://bugzilla.redhat.com/2331727
  • report
    https://bugzilla.redhat.com/2331740
  • report
    https://bugzilla.redhat.com/2331754
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-11123.html