Описание
Security update for gstreamer-plugins-good
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
- CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
- CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2025:02053-1
- E-Mail link for SUSE-SU-2025:02053-1
- SUSE Security Ratings
- SUSE Bug 1234421
- SUSE Bug 1244405
- SUSE Bug 1244406
- SUSE CVE CVE-2024-47540 page
- SUSE CVE CVE-2025-47183 page
- SUSE CVE CVE-2025-47219 page
Описание
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
Затронутые продукты
Ссылки
- CVE-2024-47540
- SUSE Bug 1234421
Описание
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Затронутые продукты
Ссылки
- CVE-2025-47183
- SUSE Bug 1244406
Описание
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Затронутые продукты
Ссылки
- CVE-2025-47219
- SUSE Bug 1244405