CVE-2024-47607: GHSL-2024-115_GHSL-2024-118: Multiple vulnerabilities in GStreamer, including stack buffer overflows, out-of-bounds write, and null pointer dereference - CVE-2024-47538, CVE-2024-47607, CVE-2024-47615, CVE-2024-47613
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gstopusdecparseheader function within gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If nchannels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GSTAUDIOCHANNELPOSITIONNONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47607?
CVE-2024-47607 is classified as a critical vulnerability due to the potential for a stack-buffer overflow leading to remote code execution.
How do I fix CVE-2024-47607?
To fix CVE-2024-47607, upgrade to a non-vulnerable version of gst-plugins-base1.0 such as 1.18.4-2+deb11u3, 1.22.0-3+deb12u3, or 1.24.10-1.
What software is affected by CVE-2024-47607?
CVE-2024-47607 affects GStreamer, specifically versions prior to 1.24.10 and gst-plugins-base1.0 version 1.18.4-2+deb11u2 and 1.22.0-3+deb12u2.
What is the specific function impacted by CVE-2024-47607?
The stack-buffer overflow in CVE-2024-47607 occurs within the gst_opus_dec_parse_header function found in gstopusdec.c.
What could be the potential impact of exploiting CVE-2024-47607?
Exploiting CVE-2024-47607 can lead to arbitrary code execution, data corruption, or crashing of the application using affected GStreamer components.