The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 750ab972-b3e8-11ef-b680-4ccc6adda413 advisory.

    The GStreamer Security Center reports:
    20 security bugs.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4071 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4071-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     February 27, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     Version        : 1.18.4-2+deb11u3     CVE ID         : CVE-2024-47537 CVE-2024-47539 CVE-2024-47540 CVE-2024-47543                      CVE-2024-47544 CVE-2024-47545 CVE-2024-47546 CVE-2024-47596                      CVE-2024-47597 CVE-2024-47598 CVE-2024-47599 CVE-2024-47601                      CVE-2024-47602 CVE-2024-47603 CVE-2024-47606 CVE-2024-47613                      CVE-2024-47774 CVE-2024-47775 CVE-2024-47776 CVE-2024-47777                      CVE-2024-47778 CVE-2024-47834

    Multiple vulnerabilities were discovered in plugins for the GStreamer     media framework and its codecs and demuxers, which may result in denial     of service or potentially the execution of arbitrary code if a malformed     media file is opened.

    For Debian 11 bullseye, these problems have been fixed in version     1.18.4-2+deb11u3.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7242 advisory.

    - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540       CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,       CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,       CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,       CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,       CVE-2024-47777, CVE-2024-47778, CVE-2024-47834

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0067-1 advisory.

    - CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
    - CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
    - CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417)
    - CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
    - CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
    - CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read.
    (boo#1234476)
    - CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read.
    (boo#1234477)
    - CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads.
    (boo#1234424)
    - CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
    - CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426)
    - CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer     dereferences. (boo#1234427)
    - CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
    - CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer.
    (boo#1234432)
    - CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
    - CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
    - CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-     of-bounds writes. (boo#1234449)
    - CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
    - CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads.
    (boo#1234446)
    - CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
    - CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
    - CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
    - CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
    - CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input     files. (boo#1234440)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected     in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function     qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code     snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing     the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This     vulnerability is fixed in 1.24.10. (CVE-2024-47597)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JavaFX (gstreamer)). Supported versions that are affected are Oracle Java SE: 8u441,     8u441-perf; Oracle GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle     GraalVM Enterprise Edition. (CVE-2024-47606)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JavaFX (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u441; Oracle     GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle     GraalVM Enterprise Edition. (CVE-2024-54534)

  - Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Node (Node.js)).     Supported versions that are affected are Oracle GraalVM for JDK: 17.0.14 and 21.0.6. Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle GraalVM for     JDK executes to compromise Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in      unauthorized creation, deletion or modification access to critical data or all Oracle GraalVM for JDK      accessible data as well as unauthorized access to critical data or complete access to all Oracle GraalVM      for JDK accessible data. (CVE-2025-23083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7242 advisory.

    * gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)

    * gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)

    * gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)

    * gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)

    * gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)

    * gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)

    * gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer     dereferences (CVE-2024-47599)

    * gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)

    * gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)

    * gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)

    * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)

    * gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)

    * gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)

    * gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer     (CVE-2024-47602)

    * gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)

    * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)

    * gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:00063-1 advisory.

    - CVE-2024-47540: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
    - CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
    - CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
    - CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
    - CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read.
    (boo#1234476)
    - CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads.
    (boo#1234424)
    - CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
    - CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer     dereferences. (boo#1234427)
    - CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
    - CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer.
    (boo#1234432)
    - CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
    - CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
    - CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-     of-bounds writes. (boo#1234449)
    - CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
    - CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads.
    (boo#1234446)
    - CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
    - CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
    - CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
    - CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
    - CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input     files. (boo#1234440)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02055-1 advisory.

    - CVE-2024-47537: Fixed OOB-write in isomp4/qtdemux.c (bsc#1234414)
    - CVE-2024-47539: Fixed OOB-write in convert_to_s334_1a (bsc#1234417)
    - CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421)
    - CVE-2024-47543: Fixed OOB-read in qtdemux_parse_container (bsc#1234462)
    - CVE-2024-47544: Fixed NULL-pointer dereferences in MP4/MOV demuxer CENC handling (bsc#1234473)
    - CVE-2024-47545: Fixed integer underflow in FOURCC_strf parsing leading to OOB-read (bsc#1234476)
    - CVE-2024-47546: Fixed integer underflow in extract_cc_from_data leading to OOB-read (bsc#1234477)
    - CVE-2024-47596: Fixed integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads     (bsc#1234424)
    - CVE-2024-47597: Fixed OOB-reads in MP4/MOV demuxer sample table parser (bsc#1234425)
    - CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer     dereferences (bsc#1234427)
    - CVE-2024-47601: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234428)
    - CVE-2024-47602: Fixed NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer     (bsc#1234432)
    - CVE-2024-47603: Fixed NULL-pointer dereference in Matroska/WebM demuxer (bsc#1234433)
    - CVE-2024-47606: Fixed integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-     bounds writes (bsc#1234449)
    - CVE-2024-47613: Fixed NULL-pointer dereference in gdk-pixbuf decoder (bsc#1234447)
    - CVE-2024-47774: Fixed integer overflow in AVI subtitle parser that leads to out-of-bounds reads     (bsc#1234446)
    - CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser (bsc#1234434)
    - CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser (bsc#1234435)
    - CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser (bsc#1234436)
    - CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser (bsc#1234439)
    - CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input     files (bsc#1234440)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202506-02 (GStreamer, GStreamer Plugins: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE     identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0063-1 advisory.

    - CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421)
    - CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414)
    - CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container. (boo#1234462)
    - CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. (boo#1234473)
    - CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read.
    (boo#1234476)
    - CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads.
    (boo#1234424)
    - CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425)
    - CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer     dereferences. (boo#1234427)
    - CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234428)
    - CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer.
    (boo#1234432)
    - CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer. (boo#1234433)
    - CVE-2024-47606: Avoid integer overflow when allocating sysmem. (bsc#1234449)
    - CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-     of-bounds writes. (boo#1234449)
    - CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
    - CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads.
    (boo#1234446)
    - CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser. (boo#1234434)
    - CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser. (boo#1234435)
    - CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser. (boo#1234436)
    - CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser. (boo#1234439)
    - CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input     files. (boo#1234440)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1131 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-47834:
    GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read     vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams.
    In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk     is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the     gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is     accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be     accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the     function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10.

    CVE-2024-47778:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to     insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a     result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB     of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This     vulnerability is fixed in 1.24.10.

    CVE-2024-47777:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to     read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If     the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4     bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10.

    CVE-2024-47776:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been     discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy     between the size of the data buffer and the size value provided to the function. This mismatch causes the     comparison  if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access     beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when     clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds     of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This     vulnerability is fixed in 1.24.10.

    CVE-2024-47775:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that     the buffer buf contains sufficient data before attempting to read from it, doing multiple     GST_READ_UINT32_LE operations without performing boundary checks. This can lead to an OOB-read when buf is     smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially     leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in     1.24.10.

    CVE-2024-47774:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function     reads the name_length value directly from the input file without checking it properly. Then, the a     condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an     integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an     OOB-read. This vulnerability is fixed in 1.24.10.

    CVE-2024-47613:
    GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has     been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position     array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write     beyond the boundaries of the position array. The value written will always be     GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows to overwrite the EIP address allocated in the     stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed     in 1.24.10.

    CVE-2024-47606:
    GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been     detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to     an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an     unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer     (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function     gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The     function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of     the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When     the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the     content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten     memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with     a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow     of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

    CVE-2024-47603:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-     demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values.
    If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null     pointer. Attempting to dereference the size field of this null pointer results in a null pointer     dereference. This vulnerability is fixed in 1.24.10.

    CVE-2024-47602:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-     demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the     following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference     a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.

    CVE-2024-47601:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function     within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer     before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is     fixed in 1.24.10.

    CVE-2024-47599:
    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function     does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens,     dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can     result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed     in 1.24.10.

    CVE-2024-47598:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size     of the stts buffer isnt properly checked before reading stts_duration, allowing the program to read 4     bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated     bounds of the stts array. This vulnerability is fixed in 1.24.10.

    CVE-2024-47597:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected     in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function     qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code     snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing     the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This     vulnerability is fixed in 1.24.10.

    CVE-2024-47596:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been     discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case,     seqh_size is read from the input file without proper validation. If seqh_size is greater than the     remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill,     which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or     potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed     in 1.24.10.

    CVE-2024-47546:
    GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been     detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction     atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction     underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-     of-bounds (OOB) read. This vulnerability is fixed in 1.24.10.

    CVE-2024-47545:
    GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been     detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction     size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent     call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This     vulnerability is fixed in 1.24.10.

    CVE-2024-47544:
    GStreamer is a library for constructing graphs of media-handling components. The function     qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is     fixed in 1.24.10.

    CVE-2024-47543:
    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function     qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the     pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container     function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This     vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation     fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

    CVE-2024-47540:
    GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack     variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within     matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable.
    Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the     uninitialized map variable, causing a function pointer hijack, as it will jump to     mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to     hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.

    CVE-2024-47539:
    GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write     vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability     arises due to a discrepancy between the size of memory allocated to the storage array and the loop     condition i * 2 < ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does     not match the loop's expected bounds, resulting in an out-of-bounds write. This bug allows for the     overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed     in 1.24.10.

    CVE-2024-47537:
    GStreamer is a library for constructing graphs of media-handling components. The program attempts to     reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count     elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this     value is big enough, this can lead to an integer overflow during the addition. As a consequence,     g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following     this, the program iterates through samples_count elements and attempts to write samples_count number of     elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This     vulnerability is fixed in 1.24.10.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
212149	FreeBSD : gstreamer1-plugins-good -- multiple vulnerabilities (750ab972-b3e8-11ef-b680-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	2024/12/7	2025/11/4	high
216931	Debian dla-4071 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	2025/2/28	2025/2/28	high
237053	Oracle Linux 9 : gstreamer1-plugins-good (ELSA-2025-7242)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	medium
215201	Photon OS 5.0: Gstreamer PHSA-2025-5.0-0461	Nessus	PhotonOS Local Security Checks	2025/2/10	2025/11/5	high
213967	SUSE SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2025:0067-1)	Nessus	SuSE Local Security Checks	2025/1/11	2025/1/11	high
228647	Linux Distros Unpatched Vulnerability : CVE-2024-47597	Nessus	Misc.	2025/3/5	2025/8/19	critical
234624	Oracle Java SE Multiple Vulnerabilities (April 2025 CPU)	Nessus	Misc.	2025/4/18	2025/8/12	critical
266572	RockyLinux 9 : gstreamer1-plugins-good (RLSA-2025:7242)	Nessus	Rocky Linux Local Security Checks	2025/10/4	2025/10/4	medium
240569	SUSE SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2025:00063-1)	Nessus	SuSE Local Security Checks	2025/6/26	2025/6/26	high
240605	SUSE SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2025:02055-1)	Nessus	SuSE Local Security Checks	2025/6/26	2025/6/26	high
215205	Photon OS 4.0: Gstreamer PHSA-2025-4.0-0744	Nessus	PhotonOS Local Security Checks	2025/2/10	2025/11/5	high
240464	GLSA-202506-02 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/6/25	2025/6/25	high
213996	SUSE SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2025:0063-1)	Nessus	SuSE Local Security Checks	2025/1/13	2025/1/13	high
239705	TencentOS Server 4: gstreamer1-plugins-good (TSSA-2024:1131)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high

检测

插件搜索

high

high

medium

high

high

critical

critical

medium

high

high

high

high

high

high