CVE-2024-47835: GHSL-2024-263: Null pointer dereference in parse_lrc in GStreamer - CVE-2024-47835
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parselrc function within gstsubparse.c. The parselrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to gstrdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to gstrdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47835?
CVE-2024-47835 has been classified as a medium severity vulnerability due to the risk of null pointer dereference.
How do I fix CVE-2024-47835?
To fix CVE-2024-47835, upgrade to versions 1.18.4-2+deb11u3, 1.22.0-3+deb12u3, or 1.24.10-1 of the gst-plugins-base1.0 package.
Which versions of GStreamer are affected by CVE-2024-47835?
CVE-2024-47835 affects versions of GStreamer prior to 1.24.10.
What component of GStreamer is impacted by CVE-2024-47835?
The parse_lrc function within gstsubparse.c is impacted by CVE-2024-47835.
What type of vulnerability is CVE-2024-47835?
CVE-2024-47835 is classified as a null pointer dereference vulnerability.