CVE-2024-47835
Fixed in a distro release EPSS 1%CVSS 6.8
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.
Products: GStreamer
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | gstreamer1-plugins-base | 1.22.12-4.el9 |
| AlmaLinux 9 | gstreamer1-plugins-base-devel | 1.22.12-4.el9 |
| AlmaLinux 9 | gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| Alpine 3.20 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.21 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.22 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.23 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.24 | gst-plugins-base | 1.24.10-r0 |
| Amazon Linux 2 | gstreamer1-plugins-base | 1.18.4-5.amzn2.0.8 |
| Amazon Linux 2 | gstreamer1-plugins-base-devel | 1.18.4-5.amzn2.0.8 |
| Amazon Linux 2 | gstreamer1-plugins-base-tools | 1.18.4-5.amzn2.0.8 |
| Debian 11 | gst-plugins-base1.0 | 1.18.4-2+deb11u3 |
| Debian 12 | gst-plugins-base1.0 | 1.22.0-3+deb12u3 |
| Debian 13 | gst-plugins-base1.0 | 1.24.10-1 |
| Debian 14 | gst-plugins-base1.0 | 1.24.10-1 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-debuginfo | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-debugsource | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-devel | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-tools | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-tools-debuginfo | 0:1.22.12-4.el9 |
| Rocky Linux 9 | gstreamer1-plugins-base | 0:1.22.12-4.el9 |
| SUSE Enterprise Storage 7.1 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Micro 5.2 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Micro 5.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Micro 5.4 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Micro 5.5 | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | gstreamer-plugins-base | 1.8.3-13.18.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | gstreamer-plugins-base | 1.8.3-13.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Micro 6.0 | gstreamer-plugins-base | 1.22.9-2.1 |
| SUSE Linux Micro 6.1 | gstreamer-plugins-base | 1.24.7-slfo.1.1_2.1 |
| SUSE Manager Proxy 4.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Manager Server 4.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| Ubuntu 16.04 LTS | gst-plugins-base0.10 | no fix |
| Ubuntu 20.04 LTS | gst-plugins-base1.0 | 1.16.3-0ubuntu1.4 |
| Ubuntu 22.04 LTS | gst-plugins-base1.0 | 1.20.1-1ubuntu0.4 |
| Ubuntu 24.04 LTS | gst-plugins-base1.0 | 1.24.2-1ubuntu0.2 |
| Ubuntu Pro 16.04 LTS | gst-plugins-base1.0 | 1.8.3-1ubuntu0.3+esm2 |
| Ubuntu Pro 18.04 LTS | gst-plugins-base1.0 | 1.14.5-0ubuntu1~18.04.3+esm1 |
| openSUSE Leap 15.6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| openSUSE Tumbleweed | gstreamer-plugins-base | 1.24.10-2.1 |