security-advisories: sync with www module

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8297>
2025-03-13 23:22:54 +00:00 · 2025-01-13 18:26:58 +00:00 · 2025-01-13 18:26:58 +00:00 · a38d40d956
commit a38d40d956
parent 22bb73b796
27 changed files with 1263 additions and 1 deletions
--- a/security-advisories/sa-2024-0002.md
+++ b/security-advisories/sa-2024-0002.md
@ -6,7 +6,7 @@
 | ----------------- | --- |
 | Summary           | Integer overflow in EXIF metadata parser leading to potential heap overwrite |
 | Date              | 2024-04-29 20:00 |
-| Affected Versions | GStreamer gst-plugins-base < 1.24.3, gst-plugins-base < 1.22.12 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.3, < 1.22.12 |
 | IDs               | GStreamer-SA-2024-0002<br/>ZDI-CAN-23896<br/>CVE-2024-4453 |

 </div>
--- a/security-advisories/sa-2024-0005.md
+++ b/security-advisories/sa-2024-0005.md
@ -0,0 +1,50 @@
+# Security Advisory 2024-0005 (GHSL-2024-094, GHSL-2024-237, GHSL-2024-241, CVE-2024-47537)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0005<br/>GHSL-2024-094, GHSL-2024-237, GHSL-2024-241<br/>CVE-2024-47537 |
+
+</div>
+
+## Details
+
+Integer overflow in the MP4/MOV demuxer's sample table parser that can lead to
+out-of-bounds writes and NULL-pointer dereferences for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger an out-of-bounds write or
+NULL-pointer dereferences that result in a crash of the application, and, in
+case of out-of-bounds writes, possibly also allow code execution through heap
+manipulation.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47537](https://www.cve.org/CVERecord?id=CVE-2024-47537)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0006.md
+++ b/security-advisories/sa-2024-0006.md
@ -0,0 +1,47 @@
+# Security Advisory 2024-0006 (GHSL-2024-246, CVE-2024-47598)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | MP4/MOV sample table parser out-of-bounds read |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0006<br/>GHSL-2024-246<br/>CVE-2024-47598 |
+
+</div>
+
+## Details
+
+Out-of-bounds reads in the MP4/MOV demuxer's sample table parser when handling raw audio tracks
+that can lead to crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger a out-of-bounds reads that result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47598](https://www.cve.org/CVERecord?id=CVE-2024-47598)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0007.md
+++ b/security-advisories/sa-2024-0007.md
@ -0,0 +1,49 @@
+# Security Advisory 2024-0007 (GHSL-2024-195, CVE-2024-47539)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | MP4/MOV Closed Caption handling out-of-bounds write |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0007<br/>GHSL-2024-195<br/>CVE-2024-47539 |
+
+</div>
+
+## Details
+
+Out-of-bounds writes in the MP4/MOV demuxer when handling CEA608 Closed Caption
+tracks that can lead to crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger a out-of-bounds writes
+that result in a crash of the application, and possibly also allow code
+execution through heap manipulation.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47539](https://www.cve.org/CVERecord?id=CVE-2024-47539)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0008.md
+++ b/security-advisories/sa-2024-0008.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0008 (GHSL-2024-235, CVE-2024-47542)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | ID3v2 parser out-of-bounds read and NULL-pointer dereference |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0008<br/>GHSL-2024-235<br/>CVE-2024-47542 |
+
+</div>
+
+## Details
+
+Out-of-bounds read and NULL-pointer dereference in ID3v2 parser that can lead
+to crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger an out-of-bounds read or
+NULL-pointer dereference that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47542](https://www.cve.org/CVERecord?id=CVE-2024-47542)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033.patch)
--- a/security-advisories/sa-2024-0009.md
+++ b/security-advisories/sa-2024-0009.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0009 (GHSL-2024-236, CVE-2024-47543)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | MP4/MOV demuxer out-of-bounds read |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0009<br/>GHSL-2024-236<br/>CVE-2024-47543 |
+
+</div>
+
+## Details
+
+Out-of-bounds read in the MP4/MOV demuxer that can lead to crashes for certain
+input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger an out-of-bounds read
+that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47543](https://www.cve.org/CVERecord?id=CVE-2024-47543)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0010.md
+++ b/security-advisories/sa-2024-0010.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0010 (GHSL-2024-242, CVE-2024-47545)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0010<br/>GHSL-2024-242<br/>CVE-2024-47545 |
+
+</div>
+
+## Details
+
+An integer overflow in the MP4/MOV demuxer that can lead to out-of-bounds
+reads that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger an integer overflow that
+can result in out-of-bounds reads and a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47545](https://www.cve.org/CVERecord?id=CVE-2024-47545)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0011.md
+++ b/security-advisories/sa-2024-0011.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0011 (GHSL-2024-238, GHSL-2024-239, GHSL-2024-240, CVE-2024-47544)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereferences in MP4/MOV demuxer CENC handling  |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0011<br/>GHSL-2024-238, GHSL-2024-239, GHSL-2024-240<br/>CVE-2024-47544 |
+
+</div>
+
+## Details
+
+Multiple NULL-pointer dereferences in the MP4/MOV demuxer's CENC handling that
+can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger a NULL-pointer
+dereferences that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47544](https://www.cve.org/CVERecord?id=CVE-2024-47544)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0012.md
+++ b/security-advisories/sa-2024-0012.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0012 (GHSL-2024-245, CVE-2024-47597)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Out-of-bounds reads in MP4/MOV demuxer sample table parser |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0012<br/>GHSL-2024-245<br/>CVE-2024-47597 |
+
+</div>
+
+## Details
+
+Multiple out-of-bounds reads in the MP4/MOV demuxer's sample table parsing and
+lack of error checking that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47597](https://www.cve.org/CVERecord?id=CVE-2024-47597)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0013.md
+++ b/security-advisories/sa-2024-0013.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0013 (GHSL-2024-243, CVE-2024-47546)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0013<br/>GHSL-2024-243<br/>CVE-2024-47546 |
+
+</div>
+
+## Details
+
+Integer underflow in the MP4/MOV demuxer that can lead to out-of-bounds reads
+and that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47546](https://www.cve.org/CVERecord?id=CVE-2024-47546)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0014.md
+++ b/security-advisories/sa-2024-0014.md
@ -0,0 +1,52 @@
+# Security Advisory 2024-0014 (GHSL-2024-166, CVE-2024-47606)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer core < 1.24.10, gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0014<br/>GHSL-2024-166<br/>CVE-2024-47606 |
+
+</div>
+
+## Details
+
+Integer overflow in the MP4/MOV demuxer and memory allocator that can lead to
+out-of-bounds writes and that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds writes that
+can result in a crash of the application, or potentially possibly also allow
+code execution through heap manipulation.
+
+## Solution
+
+The GStreamer core and gst-plugins-good 1.24.10 release addresses the issue.
+People using older branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47606](https://www.cve.org/CVERecord?id=CVE-2024-47606)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer core 1.24.10](/src/gstreamer/gstreamer-1.24.10.tar.xz)
+- [GStreamer plugins good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch (GStreamer core)](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f1cdc6f24340f6cce4cc7020628002f5c70dd6c7.patch)
+- [Patch (GStreamer plugins good)](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f8e398c46fc074f266edb3f20479c0ca31b52448.patch)
+- [Patch (combined)](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch)
--- a/security-advisories/sa-2024-0015.md
+++ b/security-advisories/sa-2024-0015.md
@ -0,0 +1,49 @@
+# Security Advisory 2024-0015 (GHSL-2024-244, CVE-2024-47596)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0015<br/>GHSL-2024-244<br/>CVE-2024-47596 |
+
+</div>
+
+## Details
+
+Integer underflow due to missing size checks in the MP4/MOV demuxer that can
+lead to out-of-bounds reads and that can cause crashes for certain input
+files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47596](https://www.cve.org/CVERecord?id=CVE-2024-47596)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch)
--- a/security-advisories/sa-2024-0016.md
+++ b/security-advisories/sa-2024-0016.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0016 (GHSL-2024-247, CVE-2024-47599)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0016<br/>GHSL-2024-247<br/>CVE-2024-47599 |
+
+</div>
+
+## Details
+
+Insufficient error handling in the JPEG decoder that can lead to NULL-pointer
+dereferences, and that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger NULL-pointer
+dereferences that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47599](https://www.cve.org/CVERecord?id=CVE-2024-47599)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch)
--- a/security-advisories/sa-2024-0017.md
+++ b/security-advisories/sa-2024-0017.md
@ -0,0 +1,49 @@
+# Security Advisory 2024-0017 (GHSL-2024-197, CVE-2024-47540)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Usage of uninitialized stack memory in Matroska/WebM demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0017<br/>GHSL-2024-197<br/>CVE-2024-47540 |
+
+</div>
+
+## Details
+
+Usage of uninitialized stack memory in Matroska/WebM demuxer that can result
+in calls to uninitialized functions pointers and crashes.
+
+## Impact
+
+It is possible for a malicious third party to trigger usage of uninitialized
+stack memory that can result in a crash of the application, or potentially
+possibly also allows code execution through stack manipulation.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47540](https://www.cve.org/CVERecord?id=CVE-2024-47540)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch)
--- a/security-advisories/sa-2024-0018.md
+++ b/security-advisories/sa-2024-0018.md
@ -0,0 +1,51 @@
+# Security Advisory 2024-0018 (GHSL-2024-248, CVE-2024-47600)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Out-of-bounds read in gst-discoverer-1.0 commandline tool |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0018<br/>GHSL-2024-248<br/>CVE-2024-47600 |
+
+</div>
+
+## Details
+
+Out-of-bounds reads in the gst-discoverer-1.0 commandline tool that can cause
+crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads that
+can result in a crash of the application.
+
+This only affects the gst-discoverer-1.0 commandline tool and not any other
+applications using GStreamer.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47600](https://www.cve.org/CVERecord?id=CVE-2024-47600)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8034.patch)
--- a/security-advisories/sa-2024-0019.md
+++ b/security-advisories/sa-2024-0019.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0019 (GHSL-2024-250, CVE-2024-47602)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0019<br/>GHSL-2024-250<br/>CVE-2024-47602 |
+
+</div>
+
+## Details
+
+NULL-pointer dereferences and out-of-bounds reads in the Matroska/WebM demuxer that can cause
+crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger NULL-pointer dereferences and out-of-bounds
+reads that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47602](https://www.cve.org/CVERecord?id=CVE-2024-47602)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch)
--- a/security-advisories/sa-2024-0020.md
+++ b/security-advisories/sa-2024-0020.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0020 (GHSL-2024-249, CVE-2024-47601)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereference in Matroska/WebM demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0020<br/>GHSL-2024-249<br/>CVE-2024-47601 |
+
+</div>
+
+## Details
+
+NULL-pointer dereference in the Matroska/WebM demuxer that can cause crashes
+for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger NULL-pointer
+dereferences that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47601](https://www.cve.org/CVERecord?id=CVE-2024-47601)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch)
--- a/security-advisories/sa-2024-0021.md
+++ b/security-advisories/sa-2024-0021.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0021 (GHSL-2024-251, CVE-2024-47603)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereference in Matroska/WebM demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0021<br/>GHSL-2024-251<br/>CVE-2024-47603 |
+
+</div>
+
+## Details
+
+NULL-pointer dereference in the Matroska/WebM demuxer that can cause crashes
+for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger NULL-pointer
+dereferences that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47603](https://www.cve.org/CVERecord?id=CVE-2024-47603)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch)
--- a/security-advisories/sa-2024-0022.md
+++ b/security-advisories/sa-2024-0022.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0022 (GHSL-2024-115, CVE-2024-47538)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Stack buffer-overflow in Vorbis decoder |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0022<br/>GHSL-2024-115<br/>CVE-2024-47538 |
+
+</div>
+
+## Details
+
+Stack buffer-overflow in Vorbis decoder that can cause crashes
+for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger stack buffer-overflows that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47538](https://www.cve.org/CVERecord?id=CVE-2024-47538)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch)
--- a/security-advisories/sa-2024-0023.md
+++ b/security-advisories/sa-2024-0023.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0023 (GHSL-2024-228, CVE-2024-47541)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Out-of-bounds write in SSA subtitle parser |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0023<br/>GHSL-2024-228<br/>CVE-2024-47541 |
+
+</div>
+
+## Details
+
+Out-of-bounds write in SSA subtitle parser that can cause crashes
+for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger an out-of-bounds write that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47541](https://www.cve.org/CVERecord?id=CVE-2024-47541)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036.patch)
--- a/security-advisories/sa-2024-0024.md
+++ b/security-advisories/sa-2024-0024.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0024 (GHSL-2024-116, CVE-2024-47607)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Stack buffer-overflow in Opus decoder |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0024<br/>GHSL-2024-116<br/>CVE-2024-47607 |
+
+</div>
+
+## Details
+
+Stack buffer-overflow in Opus decoder that can cause crashes
+for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger stack buffer-overflows that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47607](https://www.cve.org/CVERecord?id=CVE-2024-47607)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch)
--- a/security-advisories/sa-2024-0025.md
+++ b/security-advisories/sa-2024-0025.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0025 (GHSL-2024-118, CVE-2024-47613)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereference in gdk-pixbuf decoder |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0025<br/>GHSL-2024-118<br/>CVE-2024-47613 |
+
+</div>
+
+## Details
+
+A NULL-pointer dereference in the gdk-pixbuf decoder that can cause crashes for
+certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger a NULL-pointer dereference
+that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47613](https://www.cve.org/CVERecord?id=CVE-2024-47613)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch)
--- a/security-advisories/sa-2024-0026.md
+++ b/security-advisories/sa-2024-0026.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0026 (GHSL-2024-117, CVE-2024-47615)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Out-of-bounds write in Ogg demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0026<br/>GHSL-2024-117<br/>CVE-2024-47615 |
+
+</div>
+
+## Details
+
+An out-of-bounds write in the Ogg demuxer that can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds writes that
+can result in a crash of the application, or potentially possibly also allow
+code execution through heap manipulation.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47615](https://www.cve.org/CVERecord?id=CVE-2024-47615)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch)
--- a/security-advisories/sa-2024-0027.md
+++ b/security-advisories/sa-2024-0027.md
@ -0,0 +1,51 @@
+# Security Advisory 2024-0027 (GHSL-2024-261, GHSL-2024-260, GHSL-2024-259, GHSL-2024-258, CVE-2024-47778, CVE-2024-47777, CVE-2024-47776, CVE-2024-47775)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Various out-of-bounds reads in WAV parser |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0027<br/>GHSL-2024-261, GHSL-2024-260, GHSL-2024-259, GHSL-2024-258<br/>CVE-2024-47778, CVE-2024-47777, CVE-2024-47776, CVE-2024-47775 |
+
+</div>
+
+## Details
+
+Various out-of-bounds reads in the WAV parser that can cause crashes for
+certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads
+that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47778](https://www.cve.org/CVERecord?id=CVE-2024-47778)
+- [CVE-2024-47777](https://www.cve.org/CVERecord?id=CVE-2024-47777)
+- [CVE-2024-47776](https://www.cve.org/CVERecord?id=CVE-2024-47776)
+- [CVE-2024-47775](https://www.cve.org/CVERecord?id=CVE-2024-47775)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch)
--- a/security-advisories/sa-2024-0028.md
+++ b/security-advisories/sa-2024-0028.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0028 (GHSL-2024-262, CVE-2024-47774)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Integer overflow in AVI subtitle parser that leads to out-of-bounds reads |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0028<br/>GHSL-2024-262<br/>CVE-2024-47774 |
+
+</div>
+
+## Details
+
+An integer overflow in the AVI subtitle parser that can lead to out-of-bounds
+reads and can cause crashes for certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger out-of-bounds reads that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47774](https://www.cve.org/CVERecord?id=CVE-2024-47774)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch)
--- a/security-advisories/sa-2024-0029.md
+++ b/security-advisories/sa-2024-0029.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0029 (GHSL-2024-263, CVE-2024-47835)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | NULL-pointer dereference in LRC subtitle parser |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-base < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0029<br/>GHSL-2024-263<br/>CVE-2024-47835 |
+
+</div>
+
+## Details
+
+NULL-pointer dereference in LRC subtitle parser that can cause crashes for
+certain input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger NULL-pointer
+dereferences that can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-base 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47835](https://www.cve.org/CVERecord?id=CVE-2024-47835)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Base 1.24.10](/src/gst-plugins-base/gst-plugins-base-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8039.patch)
--- a/security-advisories/sa-2024-0030.md
+++ b/security-advisories/sa-2024-0030.md
@ -0,0 +1,48 @@
+# Security Advisory 2024-0030 (GHSL-2024-280, CVE-2024-47834)
+
+<div class="vertical-table">
+
+|                   |     |
+| ----------------- | --- |
+| Summary           | Use-after-free in Matroska demuxer |
+| Date              | 2024-12-03 20:00 |
+| Affected Versions | GStreamer gst-plugins-good < 1.24.10 |
+| IDs               | GStreamer-SA-2024-0030<br/>GHSL-2024-280<br/>CVE-2024-47834 |
+
+</div>
+
+## Details
+
+A use-after-free in the Matroska demuxer that can cause crashes for certain
+input files.
+
+## Impact
+
+It is possible for a malicious third party to trigger a use-after-free that
+can result in a crash of the application.
+
+## Solution
+
+The gst-plugins-good 1.24.10 release addresses the issue. People using older
+branches of GStreamer should apply the patch and recompile.
+
+## References
+
+### The GStreamer project
+
+- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)
+
+### CVE Database Entries
+
+- [CVE-2024-47834](https://www.cve.org/CVERecord?id=CVE-2024-47834)
+
+### GStreamer releases
+
+#### 1.24 (current stable)
+
+- [GStreamer 1.24.10 release notes](/releases/1.24/#1.24.10)
+- [GStreamer Plugins Good 1.24.10](/src/gst-plugins-good/gst-plugins-good-1.24.10.tar.xz)
+
+### Patches
+
+- [Patch](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch)