CVE-2024-47546: GHSL-2024-243: Integer underflow in extract_cc_from_data leading to OOB-read in GStreamer - CVE-2024-47546
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extractccfromdata function within qtdemux.c. In the FOURCCc708 case, the subtraction atomlength - 8 may result in an underflow if atomlength is less than 8. When that subtraction underflows, cclen ends up being a large number, and then cclen is passed to gmemdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47546?
CVE-2024-47546 has been classified as a high severity vulnerability due to the potential for an integer underflow leading to possible exploitation.
How do I fix CVE-2024-47546?
To fix CVE-2024-47546, update to GStreamer version 1.22.0-5+deb12u2 or 1.24.11-5 for Debian-based systems.
What components are affected by CVE-2024-47546?
CVE-2024-47546 affects GStreamer versions up to 1.24.10 and specifically the gst-plugins-good1.0 package.
What is the nature of the vulnerability in CVE-2024-47546?
The nature of the vulnerability in CVE-2024-47546 is an integer underflow in the extract_cc_from_data function within qtdemux.c.
Is CVE-2024-47546 a local or remote vulnerability?
CVE-2024-47546 may be exploited remotely as it is related to media processing in GStreamer.