CVE-2024-47544: GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling
6.8
CVSS
Description
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
Classification
CVE ID: CVE-2024-47544
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.8
Affected Products
Vendor: gstreamer
Product: gstreamer
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 21.13% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch
https://gstreamer.freedesktop.org/security/sa-2024-0011.html