CVE-2024-47540: fallo de gravedad alta en gstreamer
GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 1.0%
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
gstreamer · gstreamerCVEs relacionadas — gstreamer
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-47606HIGHGHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writesEPSS 1.7%CVE-2024-47541MEDIUMGHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parserEPSS 1.3%CVE-2024-47539HIGHGHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1aEPSS 1.3%CVE-2024-47538HIGHGHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packetEPSS 1.3%CVE-2024-47607HIGHGHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_headerEPSS 1.2%CVE-2024-47777MEDIUMGHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunkEPSS 1.2%