crítica
CVE-2024-47834
gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer, gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good, gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good, gstreamer1-plugins-good-debuginfo, gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| debian 11 | gst-plugins-good1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
Mostrar las 40 entradas de 31 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 4.0 | gstreamer | 1.25.1-1.ph4 |
| Photon OS 4.0 | gstreamer-devel | 1.25.1-1.ph4 |
| Photon OS 5.0 | gstreamer | 1.25.1-1.ph5 |
| Photon OS 5.0 | gstreamer-devel | 1.25.1-1.ph5 |
| alma 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| alma 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| alpine 3.20 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.21 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.22 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.23 | gst-plugins-good | 1.24.10-r0 |
| alpine 3.24 | gst-plugins-good | 1.24.10-r0 |
| alpine edge | gst-plugins-good | 1.24.10-r0 |
| amazon linux 2 | gstreamer1-plugins-good | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-debuginfo | 1.18.4-6.amzn2.0.7 |
| amazon linux 2 | gstreamer1-plugins-good-gtk | 1.18.4-6.amzn2.0.7 |
| debian 11 | gst-plugins-good1.0 | 1.18.4-2+deb11u3 |
| debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| debian 13 | gst-plugins-good1.0 | 1.24.10-1 |
| debian 14 | gst-plugins-good1.0 | 1.24.10-1 |
| echo | gst-plugins-good1.0 | 1.22.0-5+deb12u2 |
| Oracle Linux 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| Oracle Linux 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| rapidfort alpine 3.20 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.21 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.22 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.23 | gstreamer | 1.24.10-r0 |
| rapidfort alpine 3.24 | gstreamer | 1.24.10-r0 |
| rapidfort debian 12 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort debian 13 | gst-plugins-good1.0 | 0:1.24.10-1 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good | 0:1.22.12-4.el9 |
| rapidfort Oracle Linux 9 | gstreamer1-plugins-good-gtk | 0:1.22.12-4.el9 |
| Red Hat | gstreamer1-plugins-good | sin corrección indicada |
| Red Hat | gstreamer1-plugins-good-gtk | sin corrección indicada |
| rocky 9 | gstreamer1-plugins-good | 1.22.12-4.el9 |
| rocky 9 | gstreamer1-plugins-good-gtk | 1.22.12-4.el9 |
| ubuntu 20.04 | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 20.04-ESM | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3 |
| ubuntu 22.04 | gst-plugins-good1.0 | 1.20.3-0ubuntu1.3 |
| ubuntu 24.04 | gst-plugins-good1.0 | 1.24.2-1ubuntu1.1 |
| ubuntu 24.10 | gst-plugins-good1.0 | 1.24.8-1ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2025:7242
- https://access.redhat.com/security/cve/CVE-2024-47834
- https://bugzilla.redhat.com/2331723
- https://bugzilla.redhat.com/2331739
- https://bugzilla.redhat.com/2331741
- https://bugzilla.redhat.com/2331743
- https://bugzilla.redhat.com/2331744
- https://bugzilla.redhat.com/2331747
Las 65 referencias
- https://bugzilla.redhat.com/2331748
- https://bugzilla.redhat.com/2331749
- https://bugzilla.redhat.com/2331750
- https://bugzilla.redhat.com/2331751
- https://bugzilla.redhat.com/2331752
- https://bugzilla.redhat.com/2331755
- https://bugzilla.redhat.com/2331756
- https://bugzilla.redhat.com/2331759
- https://bugzilla.redhat.com/2331761
- https://bugzilla.redhat.com/2331762
- https://bugzilla.redhat.com/2331763
- https://bugzilla.redhat.com/show_bug.cgi?id=2331723
- https://bugzilla.redhat.com/show_bug.cgi?id=2331739
- https://bugzilla.redhat.com/show_bug.cgi?id=2331741
- https://bugzilla.redhat.com/show_bug.cgi?id=2331743
- https://bugzilla.redhat.com/show_bug.cgi?id=2331744
- https://bugzilla.redhat.com/show_bug.cgi?id=2331747
- https://bugzilla.redhat.com/show_bug.cgi?id=2331748
- https://bugzilla.redhat.com/show_bug.cgi?id=2331749
- https://bugzilla.redhat.com/show_bug.cgi?id=2331750
- https://bugzilla.redhat.com/show_bug.cgi?id=2331751
- https://bugzilla.redhat.com/show_bug.cgi?id=2331752
- https://bugzilla.redhat.com/show_bug.cgi?id=2331755
- https://bugzilla.redhat.com/show_bug.cgi?id=2331756
- https://bugzilla.redhat.com/show_bug.cgi?id=2331759
- https://bugzilla.redhat.com/show_bug.cgi?id=2331761
- https://bugzilla.redhat.com/show_bug.cgi?id=2331762
- https://bugzilla.redhat.com/show_bug.cgi?id=2331763
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47543
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47544
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47545
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47546
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47596
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47597
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47598
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47599
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47601
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47602
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47603
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47774
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47776
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47777
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47778
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47834
- https://errata.almalinux.org/9/ALSA-2025-7242.html
- https://errata.rockylinux.org/RLSA-2025:7242
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch
- https://gstreamer.freedesktop.org/security/sa-2024-0030.html
- https://linux.oracle.com/cve/CVE-2024-47834.html
- https://linux.oracle.com/errata/ELSA-2025-7242.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-47834
- https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/
- https://ubuntu.com/security/notices/USN-7176-1
- https://www.cve.org/CVERecord?id=CVE-2024-47834