GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7175-1 advisory.

    Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files.
    An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of     service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5831 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5831-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 14, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     CVE ID         : CVE-2024-47538 CVE-2024-47541 CVE-2024-47600                      CVE-2024-47607 CVE-2024-47615 CVE-2024-47835

    Multiple multiple vulnerabilities were discovered in plugins for the     GStreamer media framework and its codecs and demuxers, which may result     in denial of service or potentially the execution of arbitrary code if     a malformed media file is opened.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.22.0-3+deb12u3.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 750ab972-b3e8-11ef-b680-4ccc6adda413 advisory.

    The GStreamer Security Center reports:
    20 security bugs.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213188	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GStreamer Base Plugins vulnerabilities (USN-7175-1)	Nessus	Ubuntu Local Security Checks	high
213023	Debian dsa-5831 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	high
212149	FreeBSD : gstreamer1-plugins-good -- multiple vulnerabilities (750ab972-b3e8-11ef-b680-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2024-47835

medium

Tenable Plugins

high

high

critical