遠端 Debian 12 主機上安裝的多個套件受到 dsa-5831 公告中提及的多個弱點影響。

    - ------------------------------------------------- ------------------------------------ Debian 安全公告 DSA-5831-1 security@debian.org https://www.debian.org/security/Moritz Muehlenhoff 2024 年 12 月 14 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    套件：gst-plugins-base1.0 CVE ID：CVE-2024-47538 CVE-2024-47541 CVE-2024-47600 CVE-2024-47607 CVE-2024-47615 CVE-2024-47835

    GStreamer 媒體架構及其程式碼與解多工器的 plugin 中經發現有多個弱點，如果開啟格式錯誤的媒體檔案，可能導致拒絕服務或任意程式碼執行。

    針對穩定的發行版本 (bookworm)，已在 1.22.0-3+deb12u3 版中修正這些問題。

    建議您升級 gst-plugins-base1.0 套件。

    如需有關 gst-plugins-base1.0 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    有關 Debian 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱：https://www.debian.org/security/

    郵寄清單：debian-security-announce@lists.debian.org

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 20.04 LTS/22.04 LTS/24.04 LTS/24.10 主機上安裝的套件受到 USN-7175-1 公告中所提及的多個弱點影響。

    Antonio Morales 發現 GStreamer Base Plugin 未正確處理某些格式錯誤的媒體檔案。
    遠端攻擊者可利用這些問題造成 GStreamer Base Plugin 損毀，進而引發拒絕服務或可能執行任意程式碼。

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 AlmaLinux 9 主機已安裝受到多個弱點影響的套件如 ALSA-2025:7243 公告中所提及。

    * gstreamer1-plugins-base：ID3v2 剖析器超出邊界讀取和 NULL 指標解除參照 (CVE-2024-47542)
      * gstreamer1-plugins-base：GStreamer 在 SSA 字幕剖析器中有超出邊界寫入問題 (CVE-2024-47541)
      * gstreamer1-plugins-base：GStreamer 在 format_channel_mask 中有 OOB 讀取 (CVE-2024-47600)
      * gstreamer1-plugins-base：LRC 字幕剖析器中的 NULL 指標解除參照 (CVE-2024-47835)

Tenable 已直接從 AlmaLinux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-2284729772 advisory.

    Update to 1.24.10, fixes multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0052-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984674 advisory.

    GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability     has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This     function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are     enclosed in curly brackets ({}). The issue arises when a closing curly bracket } appears before an     opening curly bracket { in the input string. In this case, memmove() incorrectly duplicates a substring.
    With each successive loop iteration, the size passed to memmove() becomes progressively larger     (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in     1.24.10.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1-plugins-base packages installed that are affected by multiple vulnerabilities:

  - GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been     detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read     from the input file without proper validation. As a result, size can exceed the fixed size of the     pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire     pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380     bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in     1.24.10. (CVE-2024-47615)

  - GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the     lack of proper validation of user-supplied data, which can result in an integer overflow before allocating     a buffer. An attacker can leverage this vulnerability to execute code in the context of the current     process. . Was ZDI-CAN-23896. (CVE-2024-4453)

  - GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has     been detected in the `vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The position     array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write     beyond the boundaries of the position array. The value written will always be     `GST_AUDIO_CHANNEL_POSITION_NONE`. This vulnerability allows someone to overwrite the EIP address     allocated in the stack. Additionally, this bug can overwrite the `GstAudioInfo` info structure. This     vulnerability is fixed in 1.24.10. (CVE-2024-47538)

  - GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability     has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This     function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are     enclosed in curly brackets ({}). The issue arises when a closing curly bracket } appears before an     opening curly bracket { in the input string. In this case, memmove() incorrectly duplicates a substring.
    With each successive loop iteration, the size passed to memmove() becomes progressively larger     (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in     1.24.10. (CVE-2024-47541)

  - GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is     called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation,     resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by     triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. (CVE-2024-47542)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1103 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-47835:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function     calls strchr() to find the character ']' in the string line. The pointer returned by this call is then     passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns     NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed     in 1.24.10.

    CVE-2024-47615:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been     detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read     from the input file without proper validation. As a result, size can exceed the fixed size of the     pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire     pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380     bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in     1.24.10.

    CVE-2024-47607:
    GStreamer is a library for constructing graphs of media-handling components.  stack-buffer overflow has     been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-     allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of     the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to     overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

    CVE-2024-47600:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local     array position, which is defined with a fixed size of 64 elements. However, the function     gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the     for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index     greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack.
    Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory     corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

    CVE-2024-47542:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is     called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation,     resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by     triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

    CVE-2024-47541:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability     has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This     function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are     enclosed in curly brackets ({}). The issue arises when a closing curly bracket } appears before an     opening curly bracket { in the input string. In this case, memmove() incorrectly duplicates a substring.
    With each successive loop iteration, the size passed to memmove() becomes progressively larger     (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in     1.24.10.

    CVE-2024-47538:
    GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has     been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position     array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write     beyond the boundaries of the position array The value written will always be     GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows to overwrite the EIP address allocated in the     stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed     in 1.24.10.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02020-1 advisory.

    - CVE-2024-47538: Fixed stack-buffer overflow in vorbis_handle_identification_packet (bnc#1234415)
    - CVE-2024-47600: Fixed out-of-bounds read in gst-discoverer-1.0 commandline tool (bnc#1234453)
    - CVE-2024-47615: Fixed out-of-bounds write in Ogg demuxer (bnc#1234456)
    - CVE-2024-47542: Fixed ID3v2 parser out-of-bounds read and NULL-pointer dereference (bnc#1234460)
    - CVE-2024-47607: Fixed stack buffer-overflow in Opus decoder (bnc#1234455)
    - CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser (bnc#1234450)
    - CVE-2024-47541: Fixed out-of-bounds write in SSA subtitle parser (bnc#1234459)
    - CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer subtitle parser (boo#1244404)
    - CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser (boo#1244403)
    - CVE-2025-47806: Fixed Stack buffer overflow in SubRip subtitle parser (boo#1244407)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2971 advisory.

    GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability     has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This     function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are     enclosed in curly brackets ({}). The issue arises when a closing curly bracket } appears before an     opening curly bracket { in the input string. In this case, memmove() incorrectly duplicates a substring.
    With each successive loop iteration, the size passed to memmove() becomes progressively larger     (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in     1.24.10. (CVE-2024-47541)

    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is     called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation,     resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by     triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. (CVE-2024-47542)

    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local     array position, which is defined with a fixed size of 64 elements. However, the function     gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the     for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index     greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack.
    Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory     corruption or undefined behavior. This vulnerability is fixed in 1.24.10. (CVE-2024-47600)

    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function     calls strchr() to find the character ']' in the string line. The pointer returned by this call is then     passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns     NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed     in 1.24.10. (CVE-2024-47835)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
213023	Debian dsa-5831：gir1.2-gst-plugins-base-1.0 - 安全性更新	Nessus	Debian Local Security Checks	2024/12/14	2025/11/5	high
213188	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10：GStreamer Base Plugin 弱點 (USN-7175-1)	Nessus	Ubuntu Local Security Checks	2024/12/18	2025/11/5	high
241259	AlmaLinux 9gstreamer1-plugins-base (ALSA-2025:7243)	Nessus	Alma Linux Local Security Checks	2025/7/3	2025/7/3	medium
213322	Fedora 40 : mingw-directxmath / mingw-gstreamer1 / etc (2024-2284729772)	Nessus	Fedora Local Security Checks	2024/12/22	2025/11/5	high
213694	SUSE SLES12 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0052-1)	Nessus	SuSE Local Security Checks	2025/1/10	2025/11/5	high
267895	Unity Linux 20.1070a Security Update: gstreamer1-plugins-base (UTSA-2025-984674)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	medium
237983	NewStart CGSL MAIN 7.02 : gstreamer1-plugins-base Multiple Vulnerabilities (NS-SA-2025-0078)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	high
238728	TencentOS Server 4: gstreamer1-plugins-base (TSSA-2024:1103)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
240770	SUSE SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:02020-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/6/27	high
242810	NewStart CGSL MAIN 7.02 : gstreamer1-plugins-base Multiple Vulnerabilities (NS-SA-2025-0175)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
252302	Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2025-2971)	Nessus	Amazon Linux Local Security Checks	2025/8/19	2025/10/30	medium

检测

插件搜索

high

high

medium

high

high

medium

high

high

high

high

medium