The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0065-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-2284729772 advisory.

    Update to 1.24.10, fixes multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5831 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5831-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 14, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     CVE ID         : CVE-2024-47538 CVE-2024-47541 CVE-2024-47600                      CVE-2024-47607 CVE-2024-47615 CVE-2024-47835

    Multiple multiple vulnerabilities were discovered in plugins for the     GStreamer media framework and its codecs and demuxers, which may result     in denial of service or potentially the execution of arbitrary code if     a malformed media file is opened.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.22.0-3+deb12u3.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7807-1 advisory.

    Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain integer     operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-37327,     CVE-2024-4453)

    Michael Randrianantenaina discovered that GStreamer Base Plugins did not correctly handle certain memory     operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected     Ubuntu 18.04 LTS. (CVE-2023-37328)

    Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations.
    An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-47538)

    Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs,     which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)

    Antonio Morales discovered that GStreamer Base Plugins did not correctly handle certain memory operations.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,     CVE-2024-47835)

    Antonio Morales discovered that GStreamer Base Plugins did not correctly handle parsing certain inputs,     which could lead to an out-of-bounds access vulnerability. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2024-47600)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2971 advisory.

    GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability     has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This     function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are     enclosed in curly brackets ({}). The issue arises when a closing curly bracket } appears before an     opening curly bracket { in the input string. In this case, memmove() incorrectly duplicates a substring.
    With each successive loop iteration, the size passed to memmove() becomes progressively larger     (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in     1.24.10. (CVE-2024-47541)

    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is     called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation,     resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by     triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. (CVE-2024-47542)

    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local     array position, which is defined with a fixed size of 64 elements. However, the function     gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the     for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index     greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack.
    Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory     corruption or undefined behavior. This vulnerability is fixed in 1.24.10. (CVE-2024-47600)

    GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function     calls strchr() to find the character ']' in the string line. The pointer returned by this call is then     passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns     NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed     in 1.24.10. (CVE-2024-47835)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984682 advisory.

    GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local     array position, which is defined with a fixed size of 64 elements. However, the function     gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the     for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index     greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack.
    Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory     corruption or undefined behavior. This vulnerability is fixed in 1.24.10.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has     been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local     array position, which is defined with a fixed size of 64 elements. However, the function     gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the     for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index     greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack.
    Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory     corruption or undefined behavior. This vulnerability is fixed in 1.24.10. (CVE-2024-47600)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-0a5722a980 advisory.

    Update to gstreamer-1.24.10, fixes multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7243 advisory.

    - Apply patches for CVE-2024-47538, CVE-2024-47541, CVE-2024-47542,       CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835       Resolves: RHEL-70983, RHEL-71035, RHEL-70932, RHEL-71037       Resolves: RHEL-71019, RHEL-70995, RHEL-71163

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7243 advisory.

    * gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)
      * gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)
      * gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)
      * gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
213964	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0065-1)	Nessus	SuSE Local Security Checks	2025/1/11	2025/11/5	high
215201	Photon OS 5.0: Gstreamer PHSA-2025-5.0-0461	Nessus	PhotonOS Local Security Checks	2025/2/10	2025/11/5	high
213322	Fedora 40 : mingw-directxmath / mingw-gstreamer1 / etc (2024-2284729772)	Nessus	Fedora Local Security Checks	2024/12/22	2025/11/5	high
213023	Debian dsa-5831 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	2024/12/14	2025/11/5	high
269716	Ubuntu 16.04 LTS / 18.04 LTS : GStreamer Base Plugins vulnerabilities (USN-7807-1)	Nessus	Ubuntu Local Security Checks	2025/10/8	2025/10/8	high
252302	Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2025-2971)	Nessus	Amazon Linux Local Security Checks	2025/8/19	2025/10/30	medium
266937	Unity Linux 20.1070a Security Update: gstreamer1-plugins-base (UTSA-2025-984682)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	medium
229149	Linux Distros Unpatched Vulnerability : CVE-2024-47600	Nessus	Misc.	2025/3/5	2025/10/17	critical
213325	Fedora 41 : mingw-directxmath / mingw-gstreamer1 / etc (2024-0a5722a980)	Nessus	Fedora Local Security Checks	2024/12/22	2025/11/5	high
237037	Oracle Linux 9 : gstreamer1-plugins-base (ELSA-2025-7243)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	medium
241259	AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2025:7243)	Nessus	Alma Linux Local Security Checks	2025/7/3	2025/7/3	medium

检测

插件搜索

high

high

high

high

high

medium

medium

critical

high

medium

medium