Logo
›
›vulnerability›CVE-2024-47601
Name
CVE-2024-47601
Source
NVD ( link)Debian ( link)
Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10.
CWEs
CWE-476
Published Date
Updated Date
Workaround
-
Advisories
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patchPatch
https://gstreamer.freedesktop.org/security/sa-2024-0020.htmlRelease Notes
https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/Third Party Advisory

Analysis#

Affected Component
Analysis
gstreamer1.0-plugins-good
Patched

Vulnerability Ratings#

6.8
CVSSv4
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
gstreamer1.0-plugins-good
yocto
master
1.28.4
Not Affected
gstreamer1.0-plugins-good
yocto
scarthgap
1.22.12
Patched

Resolved with patches#

gstreamer1.0-plugins-good (yocto:kirkstone)

#
Title
Author
Resolve
1
matroskademux: Only unmap GstMapInfo in WavPack header
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
2
matroskademux: Skip over laces directly when postprocessing
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
3
matroskademux: Don't take data out of an empty adapter when
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
4
matroskademux: Check for big enough WavPack codec private
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
5
matroskademux: Skip over zero-sized Xiph stream headers
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
6
matroskademux: Fix off-by-one when parsing multi-channel
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
7
matroskademux: Put a copy of the codec data into the A_MS/ACM
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834

gstreamer1.0-plugins-good (yocto:scarthgap)

#
Title
Author
Resolve
1
matroskademux: Check for big enough WavPack codec private
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
2
matroskademux: Only unmap GstMapInfo in WavPack header
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
3
matroskademux: Skip over laces directly when
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
4
matroskademux: Don't take data out of an empty adapter
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
5
matroskademux: Fix off-by-one when parsing multi-channel
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
6
matroskademux: Put a copy of the codec data into the
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
7
matroskademux: Skip over zero-sized Xiph stream headers
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834