Severity
9.8
Critical severity
Details
- CVSS score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overview
About vulnerability
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified ingst_gdk_pixbuf_dec_flush within gstgdkpixbufdec.c. This function invokes memcpy, using out_pix as the destination address. out_pix is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to memcpy to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 7 ELS , Oracle Linux 7 ELS
- Affected packages:
- gstreamer1-plugins-base @ 1.18.4 (+4 more)
gst_gdk_pixbuf_dec_flush within gstgdkpixbufdec.c. This function invokes memcpy, using out_pix as the destination address. out_pix is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to memcpy to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.