gstreamer/security-advisories/sa-2024-0011.md

Security Advisory 2024-0011 (GHSL-2024-238, GHSL-2024-239, GHSL-2024-240, CVE-2024-47544)

Summary	NULL-pointer dereferences in MP4/MOV demuxer CENC handling
Date	2024-12-03 20:00
Affected Versions	GStreamer gst-plugins-good < 1.24.10
IDs	GStreamer-SA-2024-0011 GHSL-2024-238, GHSL-2024-239, GHSL-2024-240 CVE-2024-47544

Details

Multiple NULL-pointer dereferences in the MP4/MOV demuxer's CENC handling that can cause crashes for certain input files.

Impact

It is possible for a malicious third party to trigger a NULL-pointer dereferences that can result in a crash of the application.

Solution

The gst-plugins-good 1.24.10 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2024-47544

GStreamer releases

1.24 (current stable)

• GStreamer 1.24.10 release notes
• GStreamer Plugins Good 1.24.10

Patches

• Patch