CVE-2024-47542: GHSL-2024-235: Null pointer dereference in id3v2_read_synch_uint in GStreamer - CVE-2024-47542
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2readsynchuint function, located in id3v2.c. If id3v2readsynchuint is called with a null work->hdr.framedata, the pointer guint8 data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47542?
CVE-2024-47542 is classified as a medium severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2024-47542?
To fix CVE-2024-47542, upgrade to the provided patched versions of gst-plugins-base1.0, which include 1.18.4-2+deb11u3 and 1.24.10-1.
Which software is affected by CVE-2024-47542?
CVE-2024-47542 affects GStreamer versions below 1.24.10 and specific versions of gst-plugins-base1.0.
What is the nature of the vulnerability in CVE-2024-47542?
The vulnerability in CVE-2024-47542 is a null pointer dereference in the id3v2_read_synch_uint function.
What can happen if CVE-2024-47542 is exploited?
Exploitation of CVE-2024-47542 can lead to application crashes, impacting the stability of media handling applications.