CVE-2024-47543

A flaw was found in the GStreamer library. An out-of-bounds read in the MP4/MOV demuxer can lead to crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.

Moderate impact: A flaw in the GStreamer MP4/MOV demuxer (gstreamer1-plugins-good) can be triggered when an application processes a crafted media file. An out-of-bounds read may expose process memory (the current description says up to 4 GB) or cause a segmentation fault/crash. The Red Hat CVSS assessment is 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), so it treats exploitation as requiring local access and having low integrity and availability impact; NIST rates it 7.5 IMPORTANT with AV:N and high availability impact, which explains the external severity difference. The current affects mark the component as AFFECTED for Red Hat Enterprise Linux 9.6 and 10.0, Red Hat In-Vehicle OS 1.0, 1.0.z, and 1.1, and Community Projects Fedora 40/41 packages; RHEL 7 and RHEL 8.2, 8.4, 8.6, 8.8, and 8.10 are recorded as NEW with OOSS resolution rather than AFFECTED, and no separate not-affected justification is recorded. Resolutions for affected products are DELEGATED, so the impact is recorded and a fix is being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.