kritisch
CVE-2024-47600
gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (mittel), AlmaLinux (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 4.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-base, gstreamer1-plugins-base-devel, gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-base | 1.24.10-r0 |
| alpine edge | gst-plugins-base | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-base, gstreamer1-plugins-base-debuginfo, gstreamer1-plugins-base-devel und 1 weitere | 1.18.4-5.amzn2.0.8 |
| debian 11 | gst-plugins-base1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-base1.0 | 1.22.0-3+deb12u3 |
Alle 48 Einträge aus 32 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 4.0 | gstreamer | 1.25.1-1.ph4 |
| Photon OS 4.0 | gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer | 1.25.1-1.ph5 |
| Photon OS 5.0 | gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-base | 1.22.12-4.el9 |
| alma 9 | gstreamer1-plugins-base-devel | 1.22.12-4.el9 |
| alma 9 | gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-base | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-base | 1.24.10-r0 |
| alpine edge | gst-plugins-base | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-base | 1.18.4-5.amzn2.0.8 |
| amazon linux 2 | gstreamer1-plugins-base-debuginfo | 1.18.4-5.amzn2.0.8 |
| amazon linux 2 | gstreamer1-plugins-base-devel | 1.18.4-5.amzn2.0.8 |
| amazon linux 2 | gstreamer1-plugins-base-tools | 1.18.4-5.amzn2.0.8 |
| debian 11 | gst-plugins-base1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-base1.0 | 1.22.0-3+deb12u3 |
| debian 13 | gst-plugins-base1.0 | 1.24.10-1 |
| debian 14 | gst-plugins-base1.0 | 1.24.10-1 |
| echo | gst-plugins-base1.0 | 1.22.0-3+deb12u3 |
| Oracle Linux 9 | gstreamer1-plugins-base | 1.22.12-4.el9 |
| Oracle Linux 9 | gstreamer1-plugins-base-devel | 1.22.12-4.el9 |
| Oracle Linux 9 | gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| rapidfort alpine 3.20 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.21 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.22 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.23 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.24 | gstreamer | 1.24.10-r0 |
| rapidfort debian 12 | gst-plugins-base1.0 | 0:1.24.10-1 |
| rapidfort debian 13 | gst-plugins-base1.0 | 0:1.24.10-1 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-base | 0:1.22.12-4.el9 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-base-devel | 0:1.22.12-4.el9 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-base-tools | 0:1.22.12-4.el9 |
| Red Hat | gstreamer1-plugins-base | kein Fix angegeben |
| Red Hat | gstreamer1-plugins-base-devel | kein Fix angegeben |
| Red Hat | gstreamer1-plugins-base-devel-docs | kein Fix angegeben |
| Red Hat | gstreamer1-plugins-base-tools | kein Fix angegeben |
| rocky 9 | gstreamer1-plugins-base | 1.22.12-4.el9 |
| rocky 9 | gstreamer1-plugins-base-devel | 1.22.12-4.el9 |
| rocky 9 | gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| ubuntu 18.04-ESM | gst-plugins-base1.0 | 1.14.5-0ubuntu1~18.04.3+esm1 |
| ubuntu 20.04 | gst-plugins-base1.0 | 1.16.3-0ubuntu1.4 |
| ubuntu 20.04-ESM | gst-plugins-base1.0 | 1.16.3-0ubuntu1.4 |
| ubuntu 22.04 | gst-plugins-base1.0 | 1.20.1-1ubuntu0.4 |
| ubuntu 24.04 | gst-plugins-base1.0 | 1.24.2-1ubuntu0.2 |
| ubuntu 24.10 | gst-plugins-base1.0 | 1.24.8-1ubuntu0.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2025:7243
- https://access.redhat.com/security/cve/CVE-2024-47600
- https://bugzilla.redhat.com/2331717
- https://bugzilla.redhat.com/2331724
- https://bugzilla.redhat.com/2331738
- https://bugzilla.redhat.com/2331742
- https://bugzilla.redhat.com/show_bug.cgi?id=2331717
- https://bugzilla.redhat.com/show_bug.cgi?id=2331724
Alle 27 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2331738
- https://bugzilla.redhat.com/show_bug.cgi?id=2331742
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47541
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47542
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47600
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47835
- https://errata.almalinux.org/9/ALSA-2025-7243.html
- https://errata.rockylinux.org/RLSA-2025:7243
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8034.patch
- https://gstreamer.freedesktop.org/security/sa-2024-0018.html
- https://linux.oracle.com/cve/CVE-2024-47600.html
- https://linux.oracle.com/errata/ELSA-2025-7243.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-47600
- https://securitylab.github.com/advisories/GHSL-2024-248_Gstreamer/
- https://ubuntu.com/security/notices/USN-7175-1
- https://ubuntu.com/security/notices/USN-7807-1
- https://www.cve.org/CVERecord?id=CVE-2024-47600