This advisory covers seven security vulnerabilities in the GStreamer streaming media framework's base and good plugin packages. The issues include uninitialized stack memory in the Matroska/WebM demuxer (CVE-2024-47540), out-of-bounds write in isomp4/qtdemux.c (CVE-2024-47537), stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538), out-of-bounds write in the Ogg demuxer (CVE-2024-47615), null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613), stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607), and integer overflows in MP4/MOV demuxer and memory allocator leading to out-of-bounds writes (CVE-2024-47606). These vulnerabilities affect Red Hat Enterprise Linux 7 Extended Lifecycle Support packages and have been rated with an important security impact by Red Hat. The advisory references fixes available in updated packages.

The vulnerabilities involve memory corruption issues such as stack-buffer overflows, out-of-bounds writes, uninitialized memory usage, and null pointer dereferences in media processing components. These could potentially be exploited to cause application crashes, denial of service, or other unintended behavior when processing specially crafted media files. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for gstreamer1-plugins-base and gstreamer1-plugins-good addressing these vulnerabilities. Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support should apply the security update RHSA-2024:11344 promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor.