CVE-2024-47607
Publication date 12 December 2024
Last updated 20 December 2024
Ubuntu priority
Cvss 3 Severity Score
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.
Status
Package | Ubuntu Release | Status |
---|---|---|
gst-plugins-base0.10 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
16.04 LTS xenial |
Needs evaluation
|
|
gst-plugins-base1.0 | 24.10 oracular |
Fixed 1.24.8-1ubuntu0.1
|
24.04 LTS noble |
Fixed 1.24.2-1ubuntu0.2
|
|
22.04 LTS jammy |
Fixed 1.20.1-1ubuntu0.4
|
|
20.04 LTS focal |
Fixed 1.16.3-0ubuntu1.4
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
Patch details
Package | Patch details |
---|---|
gst-plugins-base1.0 |
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 · Critical |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7175-1
- GStreamer Base Plugins vulnerabilities
- 18 December 2024