Red Hat Security Advisory: gstreamer1-plugins-good security update

Fixed packages 5

Vulnerabilities 5

• High 8.6
  CVE-2024-47537

  GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

  GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that sampl…

  GStreamer GStreamer gst-plugins-good1.0 gst-plugins-good1.0 Debian Ubuntu Azure Linux Alpine
  Dec 11, 2024
• High 8.6
  CVE-2024-47539

  GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a

  GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory a…

  GStreamer GStreamer gst-plugins-good1.0 gst-plugins-good1.0 Debian Ubuntu Azure Linux Alpine
  Dec 11, 2024
• High 8.6
  CVE-2024-47540

  GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer

  GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buf…

  GStreamer GStreamer gst-plugins-good1.0 gst-plugins-good1.0 Debian Ubuntu Azure Linux Alpine
  Dec 11, 2024
• High 8.6
  CVE-2024-47606

  GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes

  GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which …

  GStreamer GStreamer gst-plugins-good1.0 gst-plugins-good1.0 Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 11, 2024
• High 8.6
  CVE-2024-47613

  GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush

  GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destinat…

  GStreamer GStreamer gst-plugins-good1.0 gst-plugins-good1.0 Debian Ubuntu Azure Linux Alpine
  Dec 11, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331722
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331726
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331753
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331760
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11348.json
• report
  https://access.redhat.com/security/cve/CVE-2024-47537
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47537
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47537
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch
• article
  https://gstreamer.freedesktop.org/security/sa-2024-0005.html
• article
  https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/
• report
  https://access.redhat.com/security/cve/CVE-2024-47539
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47539
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47539
• article
  https://gstreamer.freedesktop.org/security/sa-2024-0007.html
• article
  https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/
• report
  https://access.redhat.com/security/cve/CVE-2024-47540
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47540
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47540
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch
• article
  https://gstreamer.freedesktop.org/security/sa-2024-0017.html
• article
  https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/
• report
  https://access.redhat.com/security/cve/CVE-2024-47606
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47606
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47606
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch
• article
  https://gstreamer.freedesktop.org/security/sa-2024-0014.html
• article
  https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/
• report
  https://access.redhat.com/security/cve/CVE-2024-47613
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47613
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47613
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch
• article
  https://gstreamer.freedesktop.org/security/sa-2024-0025.html
• article
  https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/