Logo
›
›vulnerability›CVE-2024-47777
Name
CVE-2024-47777
Source
NVD ( link)Debian ( link)
Description
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10.
CWEs
CWE-125
Published Date
Updated Date
Workaround
-
Advisories
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patchPatch
https://gstreamer.freedesktop.org/security/sa-2024-0027.htmlRelease Notes
https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/Third Party Advisory

Analysis#

Affected Component
Analysis
gstreamer1.0-plugins-good
Patched

Vulnerability Ratings#

5.1
CVSSv4
9.1
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
gstreamer1.0-plugins-good
yocto
master
1.28.4
Not Affected
gstreamer1.0-plugins-good
yocto
scarthgap
1.22.12
Patched

Resolved with patches#

gstreamer1.0-plugins-good (yocto:kirkstone)

#
Title
Author
Resolve
1
wavparse: Fix parsing of acid chunk
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
2
wavparse: Check for short reads when parsing headers in pull
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
3
wavparse: Fix clipping of size to the file size
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
4
wavparse: Make sure enough data for the tag list tag is
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
5
wavparse: Check size before reading ds64 chunk
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
6
wavparse: Check that at least 32 bytes are available before
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
7
wavparse: Check that at least 4 bytes are available before
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778

gstreamer1.0-plugins-good (yocto:scarthgap)

#
Title
Author
Resolve
1
wavparse: Check for short reads when parsing headers in
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
2
wavparse: Check that at least 4 bytes are available
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
3
wavparse: Fix parsing of acid chunk
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
4
wavparse: Make sure enough data for the tag list tag is
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
5
wavparse: Fix clipping of size to the file size
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
6
wavparse: Check that at least 32 bytes are available
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778
7
wavparse: Check size before reading ds64 chunk
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47775
CVE-2024-47776
CVE-2024-47777
CVE-2024-47778