RHSA-2025:7242 - Security Advisory

标题

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)
• gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)
• gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)
• gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)
• gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)
• gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)
• gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599)
• gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)
• gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)
• gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)
• gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)
• gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)
• gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)
• gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602)
• gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)
• gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)
• gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x

修复

• BZ - 2331723 - CVE-2024-47543 gstreamer1-plugins-good: OOB-read in qtdemux_parse_container
• BZ - 2331739 - CVE-2024-47774 gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk
• BZ - 2331741 - CVE-2024-47777 gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk
• BZ - 2331743 - CVE-2024-47778 gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk
• BZ - 2331744 - CVE-2024-47775 gstreamer1-plugins-good: OOB-read in parse_ds64
• BZ - 2331747 - CVE-2024-47596 gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing
• BZ - 2331748 - CVE-2024-47599 gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
• BZ - 2331749 - CVE-2024-47834 gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate
• BZ - 2331750 - CVE-2024-47776 gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk
• BZ - 2331751 - CVE-2024-47544 gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling
• BZ - 2331752 - CVE-2024-47601 gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer
• BZ - 2331755 - CVE-2024-47597 gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples
• BZ - 2331756 - CVE-2024-47546 gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read
• BZ - 2331759 - CVE-2024-47602 gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
• BZ - 2331761 - CVE-2024-47598 gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table
• BZ - 2331762 - CVE-2024-47603 gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer
• BZ - 2331763 - CVE-2024-47545 gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read

CVE

• CVE-2024-47543
• CVE-2024-47544
• CVE-2024-47545
• CVE-2024-47546
• CVE-2024-47596
• CVE-2024-47597
• CVE-2024-47598
• CVE-2024-47599
• CVE-2024-47601
• CVE-2024-47602
• CVE-2024-47603
• CVE-2024-47774
• CVE-2024-47775
• CVE-2024-47776
• CVE-2024-47777
• CVE-2024-47778
• CVE-2024-47834

参考

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index