CVE-2024-47598: GHSL-2024-246: "OOB-read in qtdemux_merge_sample_table in GStreamer - CVE-2024-47598" - CVE-2024-47598
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemuxmergesampletable function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading sttsduration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47598?
CVE-2024-47598 is classified as a high-severity out-of-bounds read vulnerability.
How do I fix CVE-2024-47598?
To fix CVE-2024-47598, update GStreamer to version 1.24.10 or later, or apply relevant patches.
Which versions of GStreamer are affected by CVE-2024-47598?
GStreamer versions up to but not including 1.24.10 are affected by CVE-2024-47598.
What component of GStreamer does CVE-2024-47598 impact?
CVE-2024-47598 impacts the qtdemux_merge_sample_table function within the qtdemux.c component.
What is an out-of-bounds read vulnerability like CVE-2024-47598?
An out-of-bounds read vulnerability allows an attacker to read data outside the intended memory buffer, potentially leading to information leakage.