crítica
CVE-2024-47597
gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | java, java-min, jre | 1.8.0, 8.0.451 |
| Photon OS 4.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good, gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good, gstreamer1-plugins-good-debuginfo, gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| chainguard | openjdk-11-openj9, openjdk-17-openj9, openjdk-21-openj9 y 3 más | 0.53.0-r0 y 2 más |
Mostrar las 49 entradas de 33 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | java | 1.8.0, 8.0.451 |
| bitnami::Bitnami Vulnerability Database | java-min | 1.8.0, 8.0.451 |
| bitnami::Bitnami Vulnerability Database | jre | 1.8.0, 8.0.451 |
| Photon OS 4.0 | gstreamer | 1.25.1-1.ph4 |
| Photon OS 4.0 | gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer | 1.25.1-1.ph5 |
| Photon OS 5.0 | gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| alma 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-debuginfo | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| chainguard | openjdk-11-openj9 | 0.53.0-r0 |
| chainguard | openjdk-17-openj9 | 0.53.0-r0 |
| chainguard | openjdk-21-openj9 | 0.53.0-r0 |
| chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| chainguard | openjdk-8-openj9 | 0.53.0-r1 |
| debian 11 | gst-plugins-good1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| debian 13 | gst-plugins-good1.0 | 1.24.10-1 |
| debian 14 | gst-plugins-good1.0 | 1.24.10-1 |
| echo | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| Oracle Linux 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| Oracle Linux 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| rapidfort alpine 3.20 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.21 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.22 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.23 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.24 | gstreamer | 1.24.10-r0 |
| rapidfort debian 12 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort debian 13 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good | 0:1.22.12-4.el9 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good-gtk | 0:1.22.12-4.el9 |
| Red Hat | gstreamer1-plugins-good | sin corrección indicada |
| Red Hat | gstreamer1-plugins-good-gtk | sin corrección indicada |
| rocky 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| rocky 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| ubuntu 20.04 | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 20.04-ESM | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 22.04 | gst-plugins-good1.0 | 1.20.3-0ubuntu1.3 |
| ubuntu 24.04 | gst-plugins-good1.0 | 1.24.2-1ubuntu1.1 |
| ubuntu 24.10 | gst-plugins-good1.0 | 1.24.8-1ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2025:7242
- https://access.redhat.com/security/cve/CVE-2024-47597
- https://bugzilla.redhat.com/2331723
- https://bugzilla.redhat.com/2331739
- https://bugzilla.redhat.com/2331741
- https://bugzilla.redhat.com/2331743
- https://bugzilla.redhat.com/2331744
- https://bugzilla.redhat.com/2331747
Las 65 referencias
- https://bugzilla.redhat.com/2331748
- https://bugzilla.redhat.com/2331749
- https://bugzilla.redhat.com/2331750
- https://bugzilla.redhat.com/2331751
- https://bugzilla.redhat.com/2331752
- https://bugzilla.redhat.com/2331755
- https://bugzilla.redhat.com/2331756
- https://bugzilla.redhat.com/2331759
- https://bugzilla.redhat.com/2331761
- https://bugzilla.redhat.com/2331762
- https://bugzilla.redhat.com/2331763
- https://bugzilla.redhat.com/show_bug.cgi?id=2331723
- https://bugzilla.redhat.com/show_bug.cgi?id=2331739
- https://bugzilla.redhat.com/show_bug.cgi?id=2331741
- https://bugzilla.redhat.com/show_bug.cgi?id=2331743
- https://bugzilla.redhat.com/show_bug.cgi?id=2331744
- https://bugzilla.redhat.com/show_bug.cgi?id=2331747
- https://bugzilla.redhat.com/show_bug.cgi?id=2331748
- https://bugzilla.redhat.com/show_bug.cgi?id=2331749
- https://bugzilla.redhat.com/show_bug.cgi?id=2331750
- https://bugzilla.redhat.com/show_bug.cgi?id=2331751
- https://bugzilla.redhat.com/show_bug.cgi?id=2331752
- https://bugzilla.redhat.com/show_bug.cgi?id=2331755
- https://bugzilla.redhat.com/show_bug.cgi?id=2331756
- https://bugzilla.redhat.com/show_bug.cgi?id=2331759
- https://bugzilla.redhat.com/show_bug.cgi?id=2331761
- https://bugzilla.redhat.com/show_bug.cgi?id=2331762
- https://bugzilla.redhat.com/show_bug.cgi?id=2331763
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47543
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47544
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47545
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47546
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47596
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47597
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47598
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47599
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47601
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47602
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47603
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47774
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47777
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47778
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47834
- https://errata.almalinux.org/9/ALSA-2025-7242.html
- https://errata.rockylinux.org/RLSA-2025:7242
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch
- https://gstreamer.freedesktop.org/security/sa-2024-0012.html
- https://linux.oracle.com/cve/CVE-2024-47597.html
- https://linux.oracle.com/errata/ELSA-2025-7242.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-47597
- https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/
- https://ubuntu.com/security/notices/USN-7176-1
- https://www.cve.org/CVERecord?id=CVE-2024-47597