Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um einen Denial of Service Angriff durchzuführen.
Product
GStreamer ist ein Multimedia-Framework mit einer Plugin-basierten Architektur für eine Vielzahl von Plattformen.
Vulnerabilities 29
-
High 8.6
GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that sampl…
-
High 8.6
GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet
GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The position array is a stack-allocated buffer of size 64. If…
-
High 8.6
GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a
GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory a…
-
High 8.6
GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buf…
-
High 8.6
GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which …
-
High 8.6
GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 6…
-
High 8.6
GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destinat…
-
High 8.6
GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a resul…
-
Medium 6.9
GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser
GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This function is responsible for parsing and removing SS…
-
Medium 6.9
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overfl…
-
Medium 6.9
GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_…
-
Medium 6.8
GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the poi…
-
Medium 6.8
GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
-
Medium 6.8
GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_vid…
-
Medium 6.8
GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not proper…
-
Medium 6.8
GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the val…
-
Medium 6.8
GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_e…
-
Medium 6.8
GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the stri…
-
Medium 5.1
GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked…
-
Medium 5.1
GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validatio…
-
Medium 5.1
GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of th…
-
Medium 5.1
GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked befo…
-
Medium 5.1
GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed…
-
Medium 5.1
GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the in…
-
Medium 5.1
GHSL-2024-261: GStreamer has an OOB-read in parse_ds64
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before a…
-
Medium 5.1
GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value …
-
Medium 5.1
GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without c…
-
Medium 5.1
GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which c…
-
Medium 5.1
GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gs…
Revision history
-
#35
Neue Updates von Oracle Linux aufgenommen
-
#34
Neue Updates von Oracle Linux aufgenommen
-
#33
Neue Updates von Oracle Linux aufgenommen
-
#32
Neue Updates von SUSE aufgenommen
-
#31
Neue Updates von Oracle Linux und IBM aufgenommen
-
#30
Neue Updates von Ubuntu aufgenommen
-
#29
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#28
Neue Updates von SUSE aufgenommen
-
#27
Neue Updates von Amazon aufgenommen
-
#26
Neue Updates von Amazon aufgenommen
-
#25
Referenz(en) aufgenommen:
-
#24
Neue Updates von SUSE aufgenommen
-
#23
Neue Updates von SUSE aufgenommen
-
#22
Neue Updates von SUSE aufgenommen
-
#21
Neue Updates von SUSE aufgenommen
-
#20
Neue Updates von Gentoo aufgenommen
-
#19
Neue Updates von SUSE aufgenommen
-
#18
Neue Updates von Red Hat aufgenommen
-
#17
Neue Updates aufgenommen
-
#16
Neue Updates von Amazon aufgenommen
-
#15
Neue Updates von Debian aufgenommen
-
#14
Neue Updates von Amazon aufgenommen
-
#13
Neue Updates von Oracle Linux und IBM aufgenommen
-
#12
Neue Updates von ExtremeNetworks aufgenommen
-
#11
Neue Updates von IGEL aufgenommen
References
-
Debian Security Advisory DSA-5838 vom 2024-12-29
https://lists.debian.org/debian-security-announce/2024/msg00254.html
-
SUSE Security Update SUSE-SU-2025:0054-1 vom 2025-01-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MNQ2GHGDH27EWFX2SJ2D6LN572NZSBBA/
-
SUSE Security Update SUSE-SU-2025:0052-1 vom 2025-01-09
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020082.html
-
SUSE Security Update SUSE-SU-2025:0051-1 vom 2025-01-09
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020083.html
-
SUSE Security Update SUSE-SU-2025:0055-1 vom 2025-01-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZR4JWLTM5UGIYENGQ4DPVYNAVYUZGQ2S/
-
SUSE Security Update SUSE-SU-2025:0053-1 vom 2025-01-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UWQ66UIR5WRSR2SWK4O4RDXEV5TAXHWR/
-
SUSE Security Update SUSE-SU-2025:0055-1 vom 2025-01-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZR4JWLTM5UGIYENGQ4DPVYNAVYUZGQ2S/
-
openSUSE Security Update OPENSUSE-SU-2024:14576-1 vom 2024-12-14
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WXI5GJB5BPV65JTOGBHL6STLB5HKYOIT/
-
Fedora Security Advisory FEDORA-2024-0A5722A980 vom 2024-12-13
https://bodhi.fedoraproject.org/updates/FEDORA-2024-0a5722a980
-
Fedora Security Advisory FEDORA-2024-2284729772 vom 2024-12-13
https://bodhi.fedoraproject.org/updates/FEDORA-2024-2284729772
-
Debian Security Advisory DLA-3994 vom 2024-12-15
https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html
-
Debian Security Advisory DSA-5831 vom 2024-12-14
https://lists.debian.org/debian-security-announce/2024/msg00247.html
-
openSUSE Security Update OPENSUSE-SU-2024:14577-1 vom 2024-12-14
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/M64SNUMTNONUECANIAVBUNBV6RTL5TDY/
-
openSUSE Security Update OPENSUSE-SU-2024:14578-1 vom 2024-12-14
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GZDF3P2GSSY47IWYHI5OBEEMZAKWSY3E/
-
Red Hat Security Advisory RHSA-2024:11345 vom 2024-12-18
https://access.redhat.com/errata/RHSA-2024:11345
-
Red Hat Security Advisory RHSA-2024:11346 vom 2024-12-18
https://access.redhat.com/errata/RHSA-2024:11346
-
Red Hat Security Advisory RHSA-2024:11348 vom 2024-12-18
https://access.redhat.com/errata/RHSA-2024:11348
-
Oracle Linux Security Advisory ELSA-2024-11299 vom 2024-12-18
https://linux.oracle.com/errata/ELSA-2024-11299.html
-
Debian Security Advisory DLA-3999 vom 2024-12-21
https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html
-
Ubuntu Security Notice USN-7175-1 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7175-1
-
Ubuntu Security Notice USN-7174-1 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7174-1
-
Rocky Linux Security Advisory RLSA-2024:11345 vom 2024-12-19
https://errata.build.resf.org/RLSA-2024:11345
-
Rocky Linux Security Advisory RLSA-2024:11299 vom 2024-12-19
https://errata.build.resf.org/RLSA-2024:11299
-
Ubuntu Security Notice USN-7176-1 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7176-1
-
SUSE Security Update SUSE-SU-2025:0064-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/7W7QOMEYC4R74XEEEPFRHKF4KPKXOAZK/
-
SUSE Security Update SUSE-SU-2025:0063-1 vom 2025-01-10
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020091.html
-
SUSE Security Update SUSE-SU-2025:0070-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/RSNXDG7USAA66J56ZNWCMGBNR7PL7CWA/
-
SUSE Security Update SUSE-SU-2025:0062-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/L6PQD7WSYFKEV4MOXFK4RF3JE52NNZGT/
-
SUSE Security Update SUSE-SU-2025:0065-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TYNVPA6D3WYFGX2GQTXNS26KWPXVLGJC/
-
SUSE Security Update SUSE-SU-2025:0069-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BUKXU7D73HX7CQRDDBFEG7DOYTL345VF/
-
SUSE Security Update SUSE-SU-2025:0067-1 vom 2025-01-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/AFLFHXQBE5DG5JSEMYSZ3UCUIGVNZUPJ/
-
Red Hat Security Advisory RHSA-2024:11142 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11142
-
Red Hat Security Advisory RHSA-2024:11143 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11143
-
Oracle Linux Security Advisory ELSA-2024-11122 vom 2024-12-16
https://linux.oracle.com/errata/ELSA-2024-11122.html
-
Red Hat Security Advisory RHSA-2024:11121 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11121
-
Red Hat Security Advisory RHSA-2024:11122 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11122
-
Oracle Linux Security Advisory ELSA-2024-11123 vom 2024-12-16
https://linux.oracle.com/errata/ELSA-2024-11123.html
-
Red Hat Security Advisory RHSA-2024:11123 vom 2024-12-17
https://access.redhat.com/errata/RHSA-2024:11123
-
Red Hat Security Advisory RHSA-2024:11148 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11148
-
Red Hat Security Advisory RHSA-2024:11149 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11149
-
Red Hat Security Advisory RHSA-2024:11119 vom 2024-12-17
https://access.redhat.com/errata/RHSA-2024:11119
-
Red Hat Security Advisory RHSA-2024:11117 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11117
-
Red Hat Security Advisory RHSA-2024:11118 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11118
-
Red Hat Security Advisory RHSA-2024:11120 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11120
-
Red Hat Security Advisory RHSA-2024:11130 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11130
-
Red Hat Security Advisory RHSA-2024:11141 vom 2024-12-16
https://access.redhat.com/errata/RHSA-2024:11141
-
Debian Security Advisory DSA-5832 vom 2024-12-16
https://lists.debian.org/debian-security-announce/2024/msg00248.html
-
Oracle Linux Security Advisory ELSA-2024-11345 vom 2024-12-19
https://oss.oracle.com/pipermail/el-errata/2024-December/016901.html
-
Red Hat Security Advisory RHSA-2024:11344 vom 2024-12-18
https://access.redhat.com/errata/RHSA-2024:11344
-
Red Hat Security Advisory RHSA-2024:11298 vom 2024-12-17
https://access.redhat.com/errata/RHSA-2024:11298
-
Red Hat Security Advisory RHSA-2024:11299 vom 2024-12-17
https://access.redhat.com/errata/RHSA-2024:11299
-
openSUSE Security Update OPENSUSE-SU-2024:14586-1 vom 2024-12-17
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VA7KHMN2HFQR3FAIRY63QCQKG6UT7ERD/
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0005.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0006.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0007.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0008.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0009.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0010.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0011.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0012.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0013.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0014.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0015.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0016.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0017.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0018.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0019.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0020.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0021.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0022.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0023.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0024.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0025.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0026.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0027.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0028.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0029.html
-
GStreamer Security Advisory vom 2024-12-03
https://gstreamer.freedesktop.org/security/sa-2024-0030.html
-
IGEL Security Notice ISN-2025-03 vom 2025-01-16
https://kb.igel.com/security-safety/current/isn-2025-03-gstreamer-vulnerabilities
-
SUSE Security Update SUSE-SU-2025:02020-1 vom 2025-06-19
https://lists.suse.com/pipermail/sle-security-updates/2025-June/021581.html