The gstreamer1-plugins-base package in Red Hat Enterprise Linux 9.2 contains three security vulnerabilities: a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538), an out-of-bounds write in the Ogg demuxer (CVE-2024-47615), and a stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607). These issues relate to improper handling of media data buffers, potentially leading to memory corruption. Red Hat has issued an Important security advisory (RHSA-2024:11117) with updated packages that fix these vulnerabilities. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vendor provides updated packages and instructions for remediation. No CVSS base scores are included in the advisory, and no exploits are currently known in the wild.

Successful exploitation of these vulnerabilities could result in memory corruption due to stack-buffer overflows or out-of-bounds writes within the GStreamer media processing framework. This could potentially lead to application crashes or other undefined behavior. The exact impact depends on how the vulnerable functions are invoked by applications using GStreamer. No known active exploitation has been reported.

Red Hat has released updated gstreamer1-plugins-base packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 Extended Update Support and related variants should apply the security update RHSA-2024:11117 promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.