Logo
›
›vulnerability›CVE-2024-47602
Name
CVE-2024-47602
Source
NVD ( link)Debian ( link)
Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.
CWEs
CWE-125 CWE-476
Published Date
Updated Date
Workaround
-
Advisories
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patchPatch
https://gstreamer.freedesktop.org/security/sa-2024-0019.htmlRelease Notes
https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/Third Party Advisory

Analysis#

Affected Component
Analysis
gstreamer1.0-plugins-good
Patched
gstreamer1.0
Exploitable

Vulnerability Ratings#

6.8
CVSSv4
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
gstreamer1
buildroot
2025.02.x
1.24.13
Not Affected
gstreamer1
buildroot
master
1.24.13
Not Affected
gstreamer1
openwrt
master
1.26.4-r2
Not Affected
gstreamer1
openwrt
openwrt-25.12
1.26.4-r2
Not Affected
gstreamer1.0
yocto
kirkstone
1.20.7
Not Affected
gstreamer1.0-plugins-good
yocto
kirkstone
1.20.7
Patched
gstreamer1.0
yocto
master
1.28.4
Not Affected
gstreamer1.0-plugins-good
yocto
master
1.28.4
Not Affected

Resolved with patches#

gstreamer1.0-plugins-good (yocto:kirkstone)

#
Title
Author
Resolve
1
matroskademux: Only unmap GstMapInfo in WavPack header
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
2
matroskademux: Skip over laces directly when postprocessing
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
3
matroskademux: Don't take data out of an empty adapter when
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
4
matroskademux: Check for big enough WavPack codec private
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
5
matroskademux: Skip over zero-sized Xiph stream headers
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
6
matroskademux: Fix off-by-one when parsing multi-channel
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
7
matroskademux: Put a copy of the codec data into the A_MS/ACM
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834

gstreamer1.0-plugins-good (yocto:scarthgap)

#
Title
Author
Resolve
1
matroskademux: Check for big enough WavPack codec private
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
2
matroskademux: Only unmap GstMapInfo in WavPack header
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
3
matroskademux: Skip over laces directly when
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
4
matroskademux: Don't take data out of an empty adapter
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
5
matroskademux: Fix off-by-one when parsing multi-channel
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47597
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
6
matroskademux: Put a copy of the codec data into the
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834
7
matroskademux: Skip over zero-sized Xiph stream headers
=?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
CVE-2024-47540
CVE-2024-47601
CVE-2024-47602
CVE-2024-47603
CVE-2024-47834