The gstreamer1-plugins-base package in Red Hat Enterprise Linux 8.6 contains multiple memory safety vulnerabilities: a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538), an out-of-bounds write in the Ogg demuxer (CVE-2024-47615), and a stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607). These issues are categorized under CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). Red Hat Product Security has released updated packages to fix these vulnerabilities as part of advisory RHSA-2024:11141. The advisory rates the security impact as Important (high severity). No CVSS scores are provided in the advisory, but the vulnerabilities involve memory corruption risks in a widely used media framework component.

Successful exploitation of these vulnerabilities could result in memory corruption, potentially leading to application crashes or arbitrary code execution within the context of the affected software. Since the vulnerabilities affect core media processing plugins, any application using these GStreamer plugins could be impacted. No known exploits in the wild have been reported at this time.

Red Hat has released updated gstreamer1-plugins-base packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the security update described in Red Hat advisory RHSA-2024:11141 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.