BIT-jre-2024-47544: GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling

Q: What must an attacker do to trigger the issue?

An attacker needs to cause GStreamer to process MP4 or MOV media involving CENC handling. The CVSS vector indicates local attack vector, no privileges required, and user interaction is required.

Q: What is the likely impact if exploitation succeeds?

The reported impact is limited to availability: successful exploitation can cause a denial of service through a NULL-pointer dereference. The supplied vector reports no impact to confidentiality or integrity.

Q: Which versions contain the fix?

The vulnerability is fixed in GStreamer 1.24.10. The provided data does not identify the first affected version or all affected release branches.

Published Dec 11, 2024

Updated

GStreamer is a library for constructing graphs of media-handling components. The function qtdemuxparsesbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.

Affected Software

1 affected component

GStreamer GStreamer<1.24.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GStreamer to a version that resolves this vulnerability.
Fixed in 1.24.10

Event History

Dec 11, 2024

CVE Published

via OSV·06:57 PM

Data Sourced

via OSV·06:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to trigger the issue?

An attacker needs to cause GStreamer to process MP4 or MOV media involving CENC handling. The CVSS vector indicates local attack vector, no privileges required, and user interaction is required.

What is the likely impact if exploitation succeeds?

The reported impact is limited to availability: successful exploitation can cause a denial of service through a NULL-pointer dereference. The supplied vector reports no impact to confidentiality or integrity.

Which versions contain the fix?

The vulnerability is fixed in GStreamer 1.24.10. The provided data does not identify the first affected version or all affected release branches.

BIT-jre-2024-47544: GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the likely impact if exploitation succeeds?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the likely impact if exploitation succeeds?

Which versions contain the fix?