CVE-2024-47774: GHSL-2024-262: OOB-read in gst_avi_subtitle_parse_gab2_chunk in GStreamer - CVE-2024-47774
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gstavisubtitleparsegab2chunk function within gstavisubtitle.c. The function reads the namelength value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where namelength is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47774?
CVE-2024-47774 is classified as a high-severity out-of-bounds read vulnerability.
How do I fix CVE-2024-47774?
To remediate CVE-2024-47774, update the GStreamer library to version 1.24.10 or later.
Which versions of GStreamer are affected by CVE-2024-47774?
GStreamer versions prior to 1.24.10 are vulnerable to CVE-2024-47774.
Is CVE-2024-47774 exploitable in production environments?
Yes, CVE-2024-47774 can potentially be exploited to read arbitrary memory, posing risks in production environments.
What components are affected by CVE-2024-47774?
CVE-2024-47774 specifically affects the gst_avi_subtitle_parse_gab2_chunk function within the GStreamer library.