The Red Hat security advisory RHSA-2025:7242 addresses multiple memory safety vulnerabilities in the gstreamer1-plugins-good package of GStreamer. These include out-of-bounds reads in multiple parsing functions (e.g., qtdemux_parse_container, gst_avi_subtitle_parse_gab2_chunk, gst_wavparse_smpl_chunk), NULL-pointer dereferences in MP4/MOV and Matroska/WebM demuxers, use-after-free in Matroska CodecPrivate handling, and integer underflows leading to OOB-reads. The advisory covers 17 CVEs including CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, and CVE-2024-47834. These vulnerabilities are rated as moderate severity by Red Hat and affect various architectures of Red Hat Enterprise Linux 9. The advisory provides updated packages to fix these issues.

The vulnerabilities involve out-of-bounds reads, NULL-pointer dereferences, use-after-free, and integer underflows in media parsing components of GStreamer. Such memory safety issues can cause application crashes or denial of service. While no known exploits in the wild are reported, these issues could potentially be leveraged to disrupt applications that process crafted media files. The impact is limited to the affected GStreamer plugins and the applications using them.

Red Hat has released an official security update for the gstreamer1-plugins-good package in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the update as detailed in Red Hat advisory RHSA-2025:7242 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patch.