CVE-2024-47775: GHSL-2024-261: OOB-read in parse_ds64 in GStreamer - CVE-2024-47775
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parseds64 function within gstwavparse.c. The parseds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multiple GSTREADUINT32LE operations without performing boundary checks. This can lead to an OOB-read when buf is smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47775?
The severity of CVE-2024-47775 is classified as medium due to the potential for an out-of-bounds read.
How do I fix CVE-2024-47775?
To fix CVE-2024-47775, update GStreamer to version 1.24.10 or higher, or ensure you are using gst-plugins-good1.0 version 1.18.4-2+deb11u2.
What causes CVE-2024-47775?
CVE-2024-47775 is caused by the parse_ds64 function in gstwavparse.c not validating the buffer size before reading data.
Which versions of GStreamer are affected by CVE-2024-47775?
GStreamer versions prior to 1.24.10 are affected by CVE-2024-47775.
What are the potential impacts of CVE-2024-47775?
The potential impacts of CVE-2024-47775 include application crashes or unpredictable behavior due to an out-of-bounds read.