Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good | 0:1.22.12-4.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good-debuginfo | 0:1.22.12-4.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good-debugsource | 0:1.22.12-4.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good-gtk | 0:1.22.12-4.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good-gtk-debuginfo | 0:1.22.12-4.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | gstreamer1-plugins-good-qt-debuginfo | 0:1.22.12-4.el9 |
Vulnerabilities 17
-
Medium 6.9
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overfl…
-
Medium 6.9
GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_…
-
Medium 6.8
GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
-
Medium 6.8
GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_vid…
-
Medium 6.8
GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not proper…
-
Medium 6.8
GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the val…
-
Medium 6.8
GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_e…
-
Medium 5.1
GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked…
-
Medium 5.1
GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validatio…
-
Medium 5.1
GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of th…
-
Medium 5.1
GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked befo…
-
Medium 5.1
GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the in…
-
Medium 5.1
GHSL-2024-261: GStreamer has an OOB-read in parse_ds64
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before a…
-
Medium 5.1
GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value …
-
Medium 5.1
GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without c…
-
Medium 5.1
GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which c…
-
Medium 5.1
GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gs…
References
-
article
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331723
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331739
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331743
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331744
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331747
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331748
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331749
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331750
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331751
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331752
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331755
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331756
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331759
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331761
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331762
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331763
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7242.json
-
report
https://access.redhat.com/security/cve/CVE-2024-47543
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-47543
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-47543
-
article
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch
-
article
https://gstreamer.freedesktop.org/security/sa-2024-0009.html
-
article
https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/
-
report
https://access.redhat.com/security/cve/CVE-2024-47544
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-47544
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-47544
-
article
https://gstreamer.freedesktop.org/security/sa-2024-0011.html
-
article
https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/
-
report
https://access.redhat.com/security/cve/CVE-2024-47545
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-47545
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-47545
-
article
https://gstreamer.freedesktop.org/security/sa-2024-0010.html
-
article
https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/
-
report
https://access.redhat.com/security/cve/CVE-2024-47546
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-47546
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-47546