INFSA-2024:11345: gstreamer1-plugins-base security update

Information about definition

Identificator: INFSA-2024:11345

Type: security

Release date: 2025-06-26 18:47:29 UTC

Information about package

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Vulnerabilities description

  • CVE-2024-47538

    A flaw was found in the Vorbis decoder in the GStreamer library. Processing a specially crafted input file can cause a stack-based buffer overflow in the Vorbis decoder due to improper input validation, resulting in unexpected behavior or, most likely, an application crash.

  • CVE-2024-47607

    A flaw was found in the GStreamer library. A stack buffer overflow in the Opus decoder can cause crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.

  • CVE-2024-47615

    A flaw was found in the GStreamer library. An out-of-bounds write in the Ogg demuxer can cause crashes for certain input files. This vulnerability allows a malicious third party to trigger out-of-bounds writes that can result in the application's crash or possibly allow code execution through heap manipulation.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 8.8 no information
no information 9.8 no information
no information 9.8 no information
Critical, important, moderate, low

Updated packages