CVE-2024-47615: falha de alta gravidade em gstreamer
GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 1.1%
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
gstreamer · gstreamerCVEs relacionadas — gstreamer
No mesmo produto, das mais perigosas para as menos.
CVE-2024-47606HIGHGHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writesEPSS 1.7%CVE-2024-47541MEDIUMGHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parserEPSS 1.3%CVE-2024-47539HIGHGHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1aEPSS 1.3%CVE-2024-47538HIGHGHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packetEPSS 1.3%CVE-2024-47607HIGHGHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_headerEPSS 1.2%CVE-2024-47777MEDIUMGHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunkEPSS 1.2%