Skip to content
OpenAdvisories
High RHSA-2024:11117 3 CVEs

Red Hat Security Advisory: gstreamer1-plugins-base security update

Published Dec 18, 2024 · Updated Sep 23, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base 0:1.18.4-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base-debuginfo 0:1.18.4-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base-debugsource 0:1.18.4-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base-devel 0:1.18.4-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base-tools 0:1.18.4-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream gstreamer1-plugins-base-tools-debuginfo 0:1.18.4-7.el9_2

Vulnerabilities 3

  • High 8.6
    CVE-2024-47538

    GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet

    GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The position array is a stack-allocated buffer of size 64. If…

    GStreamer GStreamer gstreamer1 gst-plugins-base1.0 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-47607

    GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header

    GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 6…

    GStreamer GStreamer gstreamer1 gst-plugins-base1.0 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-47615

    GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer

    GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a resul…

    GStreamer GStreamer gst-plugins-base1.0 gstreamer1 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2331727
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2331740
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2331754
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11117.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-47538
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47538
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47538
  • article
    https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch
  • article
    https://gstreamer.freedesktop.org/security/sa-2024-0022.html
  • article
    https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/
  • report
    https://access.redhat.com/security/cve/CVE-2024-47607
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47607
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47607
  • article
    https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch
  • article
    https://gstreamer.freedesktop.org/security/sa-2024-0024.html
  • report
    https://access.redhat.com/security/cve/CVE-2024-47615
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47615
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47615
  • article
    https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch
  • article
    https://gstreamer.freedesktop.org/security/sa-2024-0026.html