In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsUpgrade AlmaLinux:8
gstreamer1-plugins-base
to version 0:1.16.1-5.el8_10 or higher.
This issue was patched in ALSA-2024:11345
.
Note: Versions mentioned in the description apply only to the upstream gstreamer1-plugins-base
package and not the gstreamer1-plugins-base
package as distributed by AlmaLinux
.
See How to fix?
for AlmaLinux:8
relevant fixed versions and status.
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.