Wind River Support Network

HomeDefectsLIN1022-12226
Fixed

LIN1022-12226 : Security Advisory - gstreamer1.0-plugins-base - CVE-2024-47615

Created: Dec 12, 2024    Updated: Mar 4, 2025
Resolved Date: Feb 27, 2025
Found In Version: 10.22.33.1
Fix Version: 10.22.33.20
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Userspace

Description

GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.

CREATE(Triage):(User=admin) CVE-2024-47615 (https://nvd.nist.gov/vuln/detail/CVE-2024-47615)
Live chat
Online