vulnerability

Ubuntu: USN-7176-1 (CVE-2024-47539): GStreamer Good Plugins vulnerabilities

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Dec 12, 2024
Added
Dec 19, 2024
Modified
Mar 27, 2026

Description

GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 < ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop's expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10.

Solutions

ubuntu-upgrade-gstreamer1-0-gtk3ubuntu-upgrade-gstreamer1-0-plugins-goodubuntu-upgrade-gstreamer1-0-pulseaudioubuntu-upgrade-gstreamer1-0-qt5ubuntu-upgrade-gstreamer1-0-qt6ubuntu-upgrade-libgstreamer-plugins-good1-0-0
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.