The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0069-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7256fae8-b3e8-11ef-b680-4ccc6adda413 advisory.

    The GStreamer Security Center reports:
    3 security bugs.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7175-1 advisory.

    Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files.
    An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of     service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0065-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference     has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is     called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation,     resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by     triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. (CVE-2024-47542)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-2284729772 advisory.

    Update to 1.24.10, fixes multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0052-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder. (boo#1234447)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0054-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3999 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3999-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 21, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     Version        : 1.18.4-2+deb11u3     CVE ID         : CVE-2024-47538 CVE-2024-47541 CVE-2024-47542 CVE-2024-47600                      CVE-2024-47607 CVE-2024-47615 CVE-2024-47835

    Multiple multiple vulnerabilities were discovered in plugins for the     GStreamer media framework and its codecs and demuxers, which may result     in denial of service or potentially the execution of arbitrary code if     a malformed media file is opened.

    For Debian 11 bullseye, these problems have been fixed in version     1.18.4-2+deb11u3.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-0a5722a980 advisory.

    Update to gstreamer-1.24.10, fixes multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
213962	SUSE SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0069-1)	Nessus	SuSE Local Security Checks	1/11/2025	1/11/2025	high
212146	FreeBSD : gstreamer1-plugins -- multiple vulnerabilities (7256fae8-b3e8-11ef-b680-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	12/7/2024	12/20/2024	critical
215201	Photon OS 5.0: Gstreamer PHSA-2025-5.0-0461	Nessus	PhotonOS Local Security Checks	2/10/2025	2/10/2025	high
213188	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GStreamer Base Plugins vulnerabilities (USN-7175-1)	Nessus	Ubuntu Local Security Checks	12/18/2024	12/20/2024	high
213964	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0065-1)	Nessus	SuSE Local Security Checks	1/11/2025	1/11/2025	high
229060	Linux Distros Unpatched Vulnerability : CVE-2024-47542	Nessus	Misc.	3/5/2025	3/5/2025	medium
213322	Fedora 40 : mingw-directxmath / mingw-gstreamer1 / etc (2024-2284729772)	Nessus	Fedora Local Security Checks	12/22/2024	12/22/2024	high
213694	SUSE SLES12 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0052-1)	Nessus	SuSE Local Security Checks	1/10/2025	1/10/2025	high
213696	SUSE SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0054-1)	Nessus	SuSE Local Security Checks	1/10/2025	1/10/2025	high
213315	Debian dla-3999 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	12/21/2024	12/21/2024	high
213325	Fedora 41 : mingw-directxmath / mingw-gstreamer1 / etc (2024-0a5722a980)	Nessus	Fedora Local Security Checks	12/22/2024	12/22/2024	high
215205	Photon OS 4.0: Gstreamer PHSA-2025-4.0-0744	Nessus	PhotonOS Local Security Checks	2/10/2025	2/10/2025	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

medium

high

high

high

high

high

high