CVE-2024-47538

Name	CVE-2024-47538
Description	GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5831-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gst-plugins-base1.0 (PTS)	bullseye (security), bullseye	1.18.4-2+deb11u2	vulnerable
	bookworm	1.22.0-3+deb12u2	vulnerable
	bookworm (security)	1.22.0-3+deb12u3	fixed
	sid, trixie	1.24.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
gst-plugins-base0.10	source	(unstable)	(unfixed)
gst-plugins-base1.0	source	bookworm	1.22.0-3+deb12u3	DSA-5831-1
gst-plugins-base1.0	source	(unstable)	1.24.10-1

Notes

https://gstreamer.freedesktop.org/security/sa-2024-0022.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3869
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5093691ef2ef5c7a6e03a20bce39db143b9cdc43
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7eb26b198beffecdba4dbb64299f9cb09a9181d6 (1.24.10)