AZL-62390
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62390.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-62390
- Upstream
- Published
- 2024-12-12T02:03:31Z
- Modified
- 2026-04-01T05:20:03.901282Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- CVE-2024-47596 affecting package gstreamer1 1.20.0-2
- Details
-
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemuxparsesvq3stsddata function within qtdemux.c. In the FOURCCSMI case, seqhsize is read from the input file without proper validation. If seqhsize is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gstbufferfill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.
- References