Out-of-bounds Read Affecting gst-plugins-good package, versions <1.24.10-r0


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE320-GSTPLUGINSGOOD-8502773
  • published14 Dec 2024
  • disclosed12 Dec 2024

Introduced: 12 Dec 2024

NewCVE-2024-47778  (opens in a new tab)
CWE-125  (opens in a new tab)

How to fix?

Upgrade Alpine:3.20 gst-plugins-good to version 1.24.10-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gst-plugins-good package and not the gst-plugins-good package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

CVSS Scores

version 3.1