CVE-2024-47603: GHSL-2024-251: Null pointer dereference in gst_matroska_demux_update_tracks in GStreamer - CVE-2024-47603
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxupdatetracks function within matroska-demux.c. The vulnerability occurs when the gstcapsisequal function is called with invalid caps values. If this happen, then in the function gstbuffergetsize the call to GSTBUFFERMEMPTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47603?
CVE-2024-47603 is classified with a severity rating that indicates a moderate risk due to the potential for denial of service through a null pointer dereference.
How do I fix CVE-2024-47603?
To address CVE-2024-47603, upgrade to GStreamer version 1.22.0-5+deb12u2 or 1.24.11-5 or later.
Which software versions are affected by CVE-2024-47603?
CVE-2024-47603 affects GStreamer versions up to 1.24.10 and the specific Debian package gst-plugins-good1.0 versions up to 1.18.4-2+deb11u2.
What type of vulnerability is CVE-2024-47603?
CVE-2024-47603 is identified as a null pointer dereference vulnerability found in the gst_matroska_demux_update_tracks function.
Is there a known exploit for CVE-2024-47603?
As of now, there are no publicly reported exploits specifically targeting CVE-2024-47603.