CVE-2024-47545
highPriorität · verfolgen · 30EPSS 0.011 · 65. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (65)
Betroffene Produkte und Versionsbereiche.
- IBM App Connect Enterprise Certified Containeralle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:certified_container
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-3586GStreamer: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-12-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-java-2024-47545GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read2026-05-06vendor · osvUS
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
- BIT-java-min-2024-47545GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read2026-05-06vendor · osvUS
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
- BIT-jre-2024-47545GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read2026-05-08vendor · osvUS
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202412-1432cnnvd
- EUVD-2024-42805enisa_euvd
- BDU:2025-00875fstec_bdu
- BIT-java-2024-47545osv
- BIT-java-min-2024-47545osv
- BIT-jre-2024-47545osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-47545cnnvd
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patchcnnvd
- https://gstreamer.freedesktop.org/security/sa-2024-0010.htmlcnnvd
- https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/cnnvd
- https://vigilance.fr/vulnerability/GStreamer-multiple-vulnerabilities-dated-16-12-2024-45906cnnvd
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patchenisa_euvd
- https://gstreamer.freedesktop.org/security/sa-2024-0010.htmlenisa_euvd
- https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan