AZL-62399

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62399.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-62399

Upstream

CVE-2024-47538

Published

2024-12-12T02:03:28Z

Modified

2026-04-01T05:20:04.676968Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

CVE-2024-47538 affecting package gstreamer1 1.20.0-2

Details

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-47538

Affected packages

Azure Linux:3 / gstreamer1

Package

Name: gstreamer1
Purl: pkg:rpm/azure-linux/gstreamer1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.20.0-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62399.json"