CVE-2024-47597: GHSL-2024-245: OOB-read in qtdemux_parse_samples in GStreamer - CVE-2024-47597
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemuxparsesamples within qtdemux.c. This issue arises when the function qtdemuxparsesamples reads data beyond the boundaries of the stream->stco buffer. The following code snippet shows the call to qtatomparsergetoffsetunchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47597?
CVE-2024-47597 has been classified with a high severity due to the potential for out-of-bounds read vulnerabilities.
How do I fix CVE-2024-47597?
To resolve CVE-2024-47597, update GStreamer to a version later than 1.24.10.
What software is affected by CVE-2024-47597?
CVE-2024-47597 affects GStreamer versions up to 1.24.10 and the gst-plugins-good1.0 package prior to specific mitigated versions.
What type of vulnerability is CVE-2024-47597?
CVE-2024-47597 is classified as an out-of-bounds read vulnerability that can lead to information disclosure.
Who reported CVE-2024-47597?
CVE-2024-47597 was reported following security analysis of the GStreamer media handling library.