Threats Tagged 'cve-2024-47606'

An integer underflow vulnerability exists in GStreamer's MP4/MOV demuxer (qtdemux_parse_theora_extension function) that can cause out-of-bounds writes and potential arbitrary code execution. This occurs due to improper handling of a size variable that underflows and is cast to a large unsigned integer, leading to insufficient memory allocation and memory corruption. The vulnerability is fixed in version 1.24.10. Red Hat has released an update for OpenJDK 8u452 on Windows that includes security fixes, but this specific vulnerability is addressed in GStreamer 1.24.10. The Red Hat advisory rates the update's overall security impact as Moderate. No known exploits are reported in the wild.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540) * gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537) * gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539) * gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613) * gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVE-2024-47606) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.