FreshPorts - VuXML

The GStreamer Security Center reports:

20 security bugs.

• CVE-2024-47537: Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes
• CVE-2024-47598: MP4/MOV sample table parser out-of-bounds read
• CVE-2024-47539: MP4/MOV Closed Caption handling out-of-bounds write
• CVE-2024-47543: MP4/MOV demuxer out-of-bounds read
• CVE-2024-47545: Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read
• CVE-2024-47544: NULL-pointer dereferences in MP4/MOV demuxer CENC handling
• CVE-2024-47597: Out-of-bounds reads in MP4/MOV demuxer sample table parser
• CVE-2024-47546: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads
• CVE-2024-47606: Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes
• CVE-2024-47596: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads
• CVE-2024-47540: Usage of uninitialized stack memory in Matroska/WebM demuxer
• CVE-2024-47602: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
• CVE-2024-47601: NULL-pointer dereference in Matroska/WebM demuxer
• CVE-2024-47603: NULL-pointer dereference in Matroska/WebM demuxer
• CVE-2024-47775: Out-of-bounds read in WAV parser
• CVE-2024-47776: Out-of-bounds read in WAV parser
• CVE-2024-47777: Out-of-bounds read in WAV parser
• CVE-2024-47778: Out-of-bounds read in WAV parser
• CVE-2024-47774: Integer overflow in AVI subtitle parser that leads to out-of-bounds reads
• CVE-2024-47834: Use-after-free in Matroska demuxer

< 1.24.10

The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.1 release:

Twelve security vulnerabilities were addressed, including:

• Out-of-bounds reads and writes in the H.266 video parser, WAV parser, MP4 and ASF demuxers, and DVB subtitle decoder.
• Integer overflows in the RIFF parser and Huffman table handling in the JPEG parser.
• Stack buffer overflows in the RTP QDM2 depayloader and H.266 parser.

These could lead to application crashes or potentially arbitrary code execution.

< 1.28.1

< 1.28.1

< 1.28.1

< 1.28.1

< 1.28.1