Moderate Security Vulnerability in gstreamer1-plugins-base: Out-of-Bounds Read and Write Issues
Summary
ALSA-2025:7243: Moderate: gstreamer1-plugins-base security update. Affects gstreamer1-plugins-base versions < 1.22.12-4.el9. Fixed in 1.22.12-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle multimedia content. It operates on a graph of filters that process media data, making it versatile for various media applications. The gstreamer1-plugins-base package includes a collection of essential plugins that are well-maintained and widely used in multimedia applications. However, recent security findings have revealed vulnerabilities within this package that could potentially compromise the integrity and security of applications utilizing it.
Vulnerability Detail
The gstreamer1-plugins-base package has been found to contain multiple vulnerabilities, including an out-of-bounds read and NULL-pointer dereference in the ID3v2 parser (CVE-2024-47542), an out-of-bounds write in the SSA subtitle parser (CVE-2024-47541), an out-of-bounds read in format_channel_mask (CVE-2024-47600), and a NULL-pointer dereference in the LRC subtitle parser (CVE-2024-47835). These vulnerabilities can lead to application crashes, data corruption, or even arbitrary code execution, posing significant risks to users and systems relying on this package.
How To Fix
Minimum fixed version
1.22.12-4.el9
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider disabling the affected plugins or using alternative media processing libraries until the update can be applied. However, this may limit functionality and should be approached with caution.
Conclusion
The gstreamer1-plugins-base package has critical vulnerabilities that need to be addressed promptly to ensure the security and stability of applications using it. Users are encouraged to update to the latest patched version and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for gstreamer1-plugins-base →
FAQ
gstreamer1-plugins-base is a package that contains essential plugins for the GStreamer multimedia framework, enabling various media processing capabilities.
The vulnerabilities can lead to application crashes, data corruption, and potential arbitrary code execution, which can compromise system security.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
Consider disabling the affected plugins or using alternative libraries until you can apply the necessary updates.
Detailed information about the vulnerabilities can be found on the CVE pages associated with each CVE identifier listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-base.
