Debian: CVE-2024-47834: gst-plugins-good1.0 -- security update

Debian: CVE-2024-47834: gst-plugins-good1.0 -- security update

Severity

9

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:C)

Published

12/12/2024

Created

01/01/2025

Added

12/31/2024

Modified

01/28/2025

Description

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10.

Solution(s)

• debian-upgrade-gst-plugins-good1-0

References

• https://attackerkb.com/topics/cve-2024-47834
• CVE - 2024-47834
• DSA-5838-1