crítica
CVE-2024-47598
gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good, gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good, gstreamer1-plugins-good-debuginfo, gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| debian 11 | gst-plugins-good1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
Mostrar las 40 entradas de 31 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gstreamer | 1.25.1-1.ph4 |
| Photon OS 4.0 | gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer | 1.25.1-1.ph5 |
| Photon OS 5.0 | gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| alma 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-debuginfo | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| debian 11 | gst-plugins-good1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| debian 13 | gst-plugins-good1.0 | 1.24.10-1 |
| debian 14 | gst-plugins-good1.0 | 1.24.10-1 |
| echo | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| Oracle Linux 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| Oracle Linux 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| rapidfort alpine 3.20 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.21 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.22 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.23 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.24 | gstreamer | 1.24.10-r0 |
| rapidfort debian 12 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort debian 13 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good | 0:1.22.12-4.el9 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good-gtk | 0:1.22.12-4.el9 |
| Red Hat | gstreamer1-plugins-good | sin corrección indicada |
| Red Hat | gstreamer1-plugins-good-gtk | sin corrección indicada |
| rocky 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| rocky 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| ubuntu 20.04 | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 20.04-ESM | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 22.04 | gst-plugins-good1.0 | 1.20.3-0ubuntu1.3 |
| ubuntu 24.04 | gst-plugins-good1.0 | 1.24.2-1ubuntu1.1 |
| ubuntu 24.10 | gst-plugins-good1.0 | 1.24.8-1ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2025:7242
- https://access.redhat.com/security/cve/CVE-2024-47598
- https://bugzilla.redhat.com/2331723
- https://bugzilla.redhat.com/2331739
- https://bugzilla.redhat.com/2331741
- https://bugzilla.redhat.com/2331743
- https://bugzilla.redhat.com/2331744
- https://bugzilla.redhat.com/2331747
Las 65 referencias
- https://bugzilla.redhat.com/2331748
- https://bugzilla.redhat.com/2331749
- https://bugzilla.redhat.com/2331750
- https://bugzilla.redhat.com/2331751
- https://bugzilla.redhat.com/2331752
- https://bugzilla.redhat.com/2331755
- https://bugzilla.redhat.com/2331756
- https://bugzilla.redhat.com/2331759
- https://bugzilla.redhat.com/2331761
- https://bugzilla.redhat.com/2331762
- https://bugzilla.redhat.com/2331763
- https://bugzilla.redhat.com/show_bug.cgi?id=2331723
- https://bugzilla.redhat.com/show_bug.cgi?id=2331739
- https://bugzilla.redhat.com/show_bug.cgi?id=2331741
- https://bugzilla.redhat.com/show_bug.cgi?id=2331743
- https://bugzilla.redhat.com/show_bug.cgi?id=2331744
- https://bugzilla.redhat.com/show_bug.cgi?id=2331747
- https://bugzilla.redhat.com/show_bug.cgi?id=2331748
- https://bugzilla.redhat.com/show_bug.cgi?id=2331749
- https://bugzilla.redhat.com/show_bug.cgi?id=2331750
- https://bugzilla.redhat.com/show_bug.cgi?id=2331751
- https://bugzilla.redhat.com/show_bug.cgi?id=2331752
- https://bugzilla.redhat.com/show_bug.cgi?id=2331755
- https://bugzilla.redhat.com/show_bug.cgi?id=2331756
- https://bugzilla.redhat.com/show_bug.cgi?id=2331759
- https://bugzilla.redhat.com/show_bug.cgi?id=2331761
- https://bugzilla.redhat.com/show_bug.cgi?id=2331762
- https://bugzilla.redhat.com/show_bug.cgi?id=2331763
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47543
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47544
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47545
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47546
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47596
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47597
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47598
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47599
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47601
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47602
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47603
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47774
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47777
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47778
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47834
- https://errata.almalinux.org/9/ALSA-2025-7242.html
- https://errata.rockylinux.org/RLSA-2025:7242
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch
- https://gstreamer.freedesktop.org/security/sa-2024-0006.html
- https://linux.oracle.com/cve/CVE-2024-47598.html
- https://linux.oracle.com/errata/ELSA-2025-7242.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-47598
- https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/
- https://ubuntu.com/security/notices/USN-7176-1
- https://www.cve.org/CVERecord?id=CVE-2024-47598