AZL-62336

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62336.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-62336

Upstream

CVE-2024-47613

Published

2024-12-12T02:03:32Z

Modified

2026-04-01T05:20:03.401261Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

CVE-2024-47613 affecting package gstreamer1 1.20.0-2

Details

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in gst_gdk_pixbuf_dec_flush within gstgdkpixbufdec.c. This function invokes memcpy, using out_pix as the destination address. out_pix is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to memcpy to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-47613

Affected packages

Azure Linux:3 / gstreamer1

Package

Name: gstreamer1
Purl: pkg:rpm/azure-linux/gstreamer1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.20.0-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62336.json"