{"schemaVersion":3,"id":"MGASA-2025-0040","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated gstreamer1.0, gstreamer1.0-plugins-base & gstreamer1.0-plugins-good packages fix security vulnerabilities\n\nGStreamer has an OOB-write in isomp4/qtdemux.c. (CVE-2024-47537)\nGStreamer has a stack-buffer overflow in\nvorbis_handle_identification_packet. (CVE-2024-47538)\nGStreamer has an OOB-write in convert_to_s334_1a. (CVE-2024-47539)\nGStreamer uses uninitialized stack memory in Matroska/WebM demuxer.\n(CVE-2024-47540)\nGStreamer has an out-of-bounds write in SSA subtitle parser.\n(CVE-2024-47541)\nGStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference.\n(CVE-2024-47542)\nGStreamer has an OOB-read in qtdemux_parse_container. (CVE-2024-47543)\nGStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC\nhandling. (CVE-2024-47544)\nGStreamer has an integer underflow in FOURCC_strf parsing leading to\nOOB-read. (CVE-2024-47545)\nGStreamer has an integer underflow in extract_cc_from_data leading to\nOOB-read. (CVE-2024-47546)\nGStreamer has an OOB-read in FOURCC_SMI_ parsing. (CVE-2024-47596)\nGStreamer has an OOB-read in qtdemux_parse_samples. (CVE-2024-47597)\nGStreamer has an OOB-read in qtdemux_merge_sample_table.\n(CVE-2024-47598)\nGStreamer Insufficient error handling in JPEG decoder that can lead to\nNULL-pointer dereferences. (CVE-2024-47599)\nGStreamer has an OOB-read in format_channel_mask. (CVE-2024-47600)\nGStreamer has a NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47601)\nGStreamer NULL-pointer dereferences and out-of-bounds reads in\nMatroska/WebM demuxer. (CVE-2024-47602)\nGStreamer NULL-pointer dereference in Matroska/WebM demuxer.\n(CVE-2024-47603)\nGStreamer Integer overflows in MP4/MOV demuxer and memory allocator that\ncan lead to out-of-bounds writes. (CVE-2024-47606)\nStack-buffer overflow in gst_opus_dec_parse_header. (CVE-2024-47607)\nGStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush.\n(CVE-2024-47613)\nGStreamer has an out-of-bounds write in Ogg demuxer. (CVE-2024-47615)\nGStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk.\n(CVE-2024-47774)\nGStreamer has an OOB-read in parse_ds64. (CVE-2024-47775)\nGStreamer has a OOB-read in gst_wavparse_cue_chunk. (CVE-2024-47776)\nGStreamer has an OOB-read in gst_wavparse_smpl_chunk. (CVE-2024-47777)\nGStreamer has an OOB-read in gst_wavparse_adtl_chunk. (CVE-2024-47778)\nGstreamer Use-After-Free read in Matroska CodecPrivate. (CVE-2024-47834)\nGstreamer NULL-pointer dereference in LRC subtitle parser.\n(CVE-2024-47835)","dates":{"published":"2025-02-06T20:01:39.000Z","modified":"2026-04-16T04:42:10.181Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"gstreamer1.0","name":"gstreamer1.0","label":"gstreamer1.0","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/gstreamer1.0","purlType":"rpm","versions":[{"text":"< 1.22.11-1.1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.11-1.1.mga9","eol":null,"hubHref":null},{"vendor":"mageia","product":"gstreamer1.0-plugins-base","name":"gstreamer1.0-plugins-base","label":"gstreamer1.0-plugins-base","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/gstreamer1.0-plugins-base","purlType":"rpm","versions":[{"text":"< 1.22.11-1.2.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.11-1.2.mga9","eol":null,"hubHref":null},{"vendor":"mageia","product":"gstreamer1.0-plugins-good","name":"gstreamer1.0-plugins-good","label":"gstreamer1.0-plugins-good","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/gstreamer1.0-plugins-good","purlType":"rpm","versions":[{"text":"< 1.22.11-1.1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.11-1.1.mga9","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2025-0040.html","label":"advisories.mageia.org/MGASA-2025-0040.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33856","label":"bugs.mageia.org/show_bug.cgi?id=33856","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2024/12/13/1","label":"www.openwall.com/lists/oss-security/2024/12/13/1","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00247.html","label":"lists.debian.org/debian-security-announce/2024/msg00247.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00248.html","label":"lists.debian.org/debian-security-announce/2024/msg00248.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00254.html","label":"lists.debian.org/debian-security-announce/2024/msg00254.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://ubuntu.com/security/notices/USN-7174-1","label":"ubuntu.com/security/notices/USN-7174-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7176-1","label":"ubuntu.com/security/notices/USN-7176-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":["CVE-2024-47537","CVE-2024-47538","CVE-2024-47539","CVE-2024-47540","CVE-2024-47541","CVE-2024-47542","CVE-2024-47543","CVE-2024-47544","CVE-2024-47545","CVE-2024-47546","CVE-2024-47596","CVE-2024-47597","CVE-2024-47598","CVE-2024-47599","CVE-2024-47600","CVE-2024-47601","CVE-2024-47602","CVE-2024-47603","CVE-2024-47613","CVE-2024-47774","CVE-2024-47835"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-02-06T20:01:39.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T04:42:10.181Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:38:32.446Z","stale":false,"partial":false}}