CVE-2024-47541
Publication date 12 December 2024
Last updated 18 December 2024
Ubuntu priority
Cvss 3 Severity Score
GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are enclosed in curly brackets ({}). The issue arises when a closing curly bracket "}" appears before an opening curly bracket "{" in the input string. In this case, memmove() incorrectly duplicates a substring. With each successive loop iteration, the size passed to memmove() becomes progressively larger (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in 1.24.10.
Status
Package | Ubuntu Release | Status |
---|---|---|
gst-plugins-base0.10 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
16.04 LTS xenial |
Needs evaluation
|
|
gst-plugins-base1.0 | 24.10 oracular |
Fixed 1.24.8-1ubuntu0.1
|
24.04 LTS noble |
Fixed 1.24.2-1ubuntu0.2
|
|
22.04 LTS jammy |
Fixed 1.20.1-1ubuntu0.4
|
|
20.04 LTS focal |
Fixed 1.16.3-0ubuntu1.4
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
Patch details
Package | Patch details |
---|---|
gst-plugins-base1.0 |
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7175-1
- GStreamer Base Plugins vulnerabilities
- 18 December 2024