CVE-2024-47599: GHSL-2024-247: Null pointer dereference in gst_jpeg_dec_negotiate in GStreamer - CVE-2024-47599
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstjpegdecnegotiate function in gstjpegdec.c. This function does not check for a NULL return value from gstvideodecodersetoutputstate. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47599?
CVE-2024-47599 has a severity rating that indicates a potential impact on application stability due to a null pointer dereference.
How do I fix CVE-2024-47599?
To fix CVE-2024-47599, update the GStreamer library to version 1.22.0-5+deb12u2 or 1.24.11-5.
Which GStreamer versions are affected by CVE-2024-47599?
CVE-2024-47599 affects GStreamer versions up to 1.24.10.
What are the potential consequences of CVE-2024-47599?
The consequences of CVE-2024-47599 may include application crashes or instability when processing media.
Is there a workaround for CVE-2024-47599?
There are currently no known workarounds for CVE-2024-47599; updating GStreamer is the recommended solution.