{"id":121098,"date":"2024-12-20T15:46:09","date_gmt":"2024-12-20T13:46:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej"},"modified":"2024-12-20T15:46:09","modified_gmt":"2024-12-20T13:46:09","slug":"v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","title":{"rendered":"29 vulnerabilities have been identified in the GStreamer multimedia framework.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The multimedia framework GStreamer, used in GNOME, has 29 vulnerabilities identified. Eight vulnerabilities lead to buffer overflow, and one (CVE-2024-47540) allows for function pointer overwriting. These vulnerabilities can potentially be exploited by attackers to execute code when processing malformed multimedia data in MKV, MP4, Ogg, Vorbis, and Opus formats, as well as subtitles in SSA format. The remaining vulnerabilities lead to null pointer dereferencing or reading from memory outside the buffer, potentially allowing for crash initiation. <\/p>\n
The GStreamer library is used for parsing multimedia files in applications like Nautilus (GNOME Files), GNOME Videos, and Rhythmbox, as well as in the GNOME-developed search engine tracker-miners. This engine is installed as a dependency in many distributions for the tracker-extract package, which is used in GNOME for automatically parsing metadata in new files. Among other things, the service indexes all files in the home directory without user action. Thus, to launch an attack, it is sufficient to create a specially crafted multimedia file in the user's directory, and the vulnerability will be exploited during its automatic indexing. <\/p>\n
The vulnerabilities have been fixed in GStreamer update 1.24.10 (packages gst-plugins-good, gst-plugins-base, gstreamer-plugins-ogg, gstreamer-plugins-opus, gstreamer-plugins-vorbis). In addition to the 29 vulnerabilities identified by researchers at GitHub Security Lab, version 1.24.10 has also reported fixes for another 11 vulnerabilities. You can track updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. In most distributions with GNOME, the tracker-miners component is activated by default and loaded as a strict dependency for the Nautilus (GNOME Files) file manager. To disable tracker-miners, you can use the following commands: <\/p>\n