Critical Security Update for gstreamer1-plugins-base: Addressing Multiple Vulnerabilities
Summary
ALSA-2024:11123: Important: gstreamer1-plugins-base security update. Affects gstreamer1-plugins-base versions < 1.22.1-3.el9_5. Fixed in 1.22.1-3.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle audio and video data. The gstreamer1-plugins-base package contains essential plug-ins that are well-maintained and widely used in various multimedia applications. However, recent security assessments have revealed critical vulnerabilities within this package, necessitating immediate attention from users and developers alike.
Vulnerability Detail
The vulnerabilities identified in gstreamer1-plugins-base include a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538), an out-of-bounds write in the Ogg demuxer (CVE-2024-47615), and another stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607). These issues can lead to severe consequences, including application crashes, potential data corruption, and exploitation by malicious actors to execute arbitrary code.
How To Fix
Minimum fixed version
1.22.1-3.el9_5
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the affected plug-ins until the update can be applied. This can be done by modifying the application configuration files to exclude the use of the vulnerable components.
Conclusion
The vulnerabilities in gstreamer1-plugins-base pose significant risks to applications utilizing this multimedia framework. Immediate action is required to update the affected packages to the latest patched versions to safeguard against potential exploitation. Users are encouraged to monitor their systems and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for gstreamer1-plugins-base →
FAQ
gstreamer1-plugins-base is a collection of essential plug-ins for the GStreamer multimedia framework, enabling various audio and video processing capabilities.
The identified vulnerabilities can lead to application crashes, data corruption, and potential exploitation by attackers to execute arbitrary code.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check for vulnerabilities without requiring any installation.
Yes, you can temporarily disable the affected plug-ins in your application configuration to mitigate risks until the update is applied.
It is advisable to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you are protected against newly discovered vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
