{"id":121098,"date":"2024-12-20T15:46:09","date_gmt":"2024-12-20T13:46:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej"},"modified":"2024-12-20T15:46:09","modified_gmt":"2024-12-20T13:46:09","slug":"v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","title":{"rendered":"Vingt-neuf vuln\u00e9rabilit\u00e9s d\u00e9tect\u00e9es dans le framework multim\u00e9dia GStreamer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dans le framework multim\u00e9dia GStreamer, utilis\u00e9 dans GNOME, 29 vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes. Huit d'entre elles entra\u00eenent une \u00e9criture de donn\u00e9es en dehors des limites d'un tampon, et une autre (CVE-2024-47540) permet de r\u00e9\u00e9crire un pointeur de fonction. Ces vuln\u00e9rabilit\u00e9s peuvent potentiellement \u00eatre exploit\u00e9es par des attaquants pour ex\u00e9cuter du code lors du traitement de donn\u00e9es multim\u00e9dias mal form\u00e9es dans les formats MKV, MP4, Ogg, Vorbis et Opus, ainsi que de sous-titres au format SSA. Les autres vuln\u00e9rabilit\u00e9s entra\u00eenent un dereferencement de pointeur nul ou une lecture en dehors de la m\u00e9moire du tampon, ce qui peut \u00eatre utilis\u00e9 pour provoquer un plantage. <\/p>\n

La biblioth\u00e8que GStreamer est utilis\u00e9e pour analyser des fichiers multim\u00e9dias dans des applications comme Nautilus (Fichiers GNOME), GNOME Vid\u00e9os et Rhythmbox, ainsi que dans le moteur de recherche tracker-miners d\u00e9velopp\u00e9 par GNOME. Ce moteur est install\u00e9 dans de nombreuses distributions comme une d\u00e9pendance au paquet tracker-extract, utilis\u00e9 dans GNOME pour analyser automatiquement les m\u00e9tadonn\u00e9es des nouveaux fichiers. Entre autres, ce service indexe tous les fichiers dans le r\u00e9pertoire personnel sans intervention de l'utilisateur. Ainsi, pour attaquer, il suffit de faire appara\u00eetre dans le r\u00e9pertoire utilisateur un fichier multim\u00e9dia sp\u00e9cialement cr\u00e9\u00e9, et la vuln\u00e9rabilit\u00e9 sera exploit\u00e9e lors de son indexation automatique. <\/p>\n

Les vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans la mise \u00e0 jour GStreamer 1.24.10 (paquets gst-plugins-good, gst-plugins-base, gstreamer-plugins-ogg, gstreamer-plugins-opus, gstreamer-plugins-vorbis). En plus des 29 vuln\u00e9rabilit\u00e9s identifi\u00e9es par les chercheurs de GitHub Security Lab, la version 1.24.10 annonce la correction de 11 autres vuln\u00e9rabilit\u00e9s. Vous pouvez suivre l'arriv\u00e9e des mises \u00e0 jour dans les distributions sur les pages suivantes : Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. Dans la plupart des distributions avec GNOME, le composant tracker-miners est activ\u00e9 par d\u00e9faut et charg\u00e9 comme une d\u00e9pendance rigide au gestionnaire de fichiers Nautilus (Fichiers GNOME). Pour d\u00e9sactiver tracker-miners, vous pouvez utiliser les commandes : <\/p>\n

systemctl --user mask tracker-store.service tracker-miner-fs.service tracker-miner-rss.service tracker-extract.service tracker-miner-apps.service tracker-writeback.service tracker reset --hard
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 29 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0443\u0444\u0435\u0440\u0430, \u0430 \u043e\u0434\u043d\u0430 (CVE-2024-47540) \u043a \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e. \u0423\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 MKV, MP4, Ogg, Vorbis \u0438 Opus, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0443\u0431\u0442\u0438\u0442\u0440\u043e\u0432 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121098","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4729 vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans le cadre multim\u00e9dia GStreamer | ProHoster","description":"Dans le framework multim\u00e9dia GStreamer, utilis\u00e9 dans GNOME, 29 vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes. Huit d'entre elles entra\u00eenent une \u00e9criture de donn\u00e9es en dehors des limites d'un tampon, et une autre (CVE-2024-47540) permet de r\u00e9\u00e9crire un pointeur de fonction.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 29 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 29 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0443\u0444\u0435\u0440\u0430, \u0430 \u043e\u0434\u043d\u0430 (CVE-2024-47540) \u043a \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-multimedijnom-frejmvorke-gstreamer-vyyavleno-29-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-20T13:46:09+00:00","article:modified_time":"2024-12-20T13:46:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121098","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:01:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:01:21","updated":"2026-01-23 09:01:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121098","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=121098"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121098\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=121098"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=121098"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=121098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}