DEBIAN-CVE-2024-47606

Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2024-47606
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47606.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-47606
Upstream
Published
2024-12-12T02:03:32Z
Modified
2025-09-19T07:34:06.842513Z
Summary
[none]
Details

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemuxparsetheoraextension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gstbuffernewandalloc. The function gstbuffernewallocate then attempts to allocate memory, eventually calling sysmemnewblock. The function _sysmemnewblock adds alignment and header size to the (unsigned) size, causing the overflow of the 'slicesize' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gstbufferfill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gstmemoryunmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->memunmapfull function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

References

Affected packages

Debian:11

gst-plugins-good1.0

Package

Name
gst-plugins-good1.0
Purl
pkg:deb/debian/gst-plugins-good1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-2+deb11u3

Affected versions

1.*

1.18.4-2
1.18.4-2+deb11u1
1.18.4-2+deb11u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

gstreamer1.0

Package

Name
gstreamer1.0
Purl
pkg:deb/debian/gstreamer1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-2.1+deb11u1

Affected versions

1.*

1.18.4-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12

gst-plugins-good1.0

Package

Name
gst-plugins-good1.0
Purl
pkg:deb/debian/gst-plugins-good1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.0-5+deb12u2

Affected versions

1.*

1.22.0-5
1.22.0-5+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

gstreamer1.0

Package

Name
gstreamer1.0
Purl
pkg:deb/debian/gstreamer1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.0-2+deb12u1

Affected versions

1.*

1.22.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13

gst-plugins-good1.0

Package

Name
gst-plugins-good1.0
Purl
pkg:deb/debian/gst-plugins-good1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

gstreamer1.0

Package

Name
gstreamer1.0
Purl
pkg:deb/debian/gstreamer1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14

gst-plugins-good1.0

Package

Name
gst-plugins-good1.0
Purl
pkg:deb/debian/gst-plugins-good1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

gstreamer1.0

Package

Name
gstreamer1.0
Purl
pkg:deb/debian/gstreamer1.0?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}