Use of Uninitialized Variable Affecting gstreamer/gstreamer package, versions [,1.24.10)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-GSTREAMERGSTREAMER-8501851
  • published13 Dec 2024
  • disclosed11 Dec 2024
  • creditAntonio Morales

Introduced: 11 Dec 2024

NewCVE-2024-47540  (opens in a new tab)
CWE-457  (opens in a new tab)

How to fix?

Upgrade gstreamer/gstreamer to version 1.24.10 or higher.

Overview

Affected versions of this package are vulnerable to Use of Uninitialized Variable through the gst_matroska_demux_add_wvpk_header function within matroska-demux.c file. An attacker can hijack the execution flow and potentially execute arbitrary code by exploiting the uninitialized map variable when size is less than 4.

CVSS Scores

version 3.1