{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/vex/2024/cve-2024-47540-els_os-oraclelinux7els.json" } ], "tracking": { "current_release_date": "2026-07-23T22:52:38Z", "generator": { "date": "2026-07-23T22:52:38Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-47540-ELS_OS-ORACLELINUX7ELS", "initial_release_date": "2024-12-12T02:03:00Z", "revision_history": [ { "date": "2024-12-12T02:03:00Z", "number": "1", "summary": "Initial version" }, { "date": "2025-11-29T11:00:43Z", "number": "2", "summary": "Official Publication" }, { "date": "2025-12-23T22:15:38Z", "number": "3", "summary": "Update document" }, { "date": "2026-06-13T01:48:10Z", "number": "4", "summary": "Update document" }, { "date": "2026-07-23T22:52:38Z", "number": "5", "summary": "Update document" } ], "status": "final", "version": "5" }, "title": "Security update on CVE-2024-47540" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 7", "product": { "name": "Oracle Linux 7", "product_id": "Oracle-Linux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.el7.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.el7.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els3?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-tools@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product_id": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel-docs@1.10.4-2.el7.tuxcare.els3?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch" }, "product_reference": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-47540", "cwe": { "id": "CWE-457", "name": "Use of Uninitialized Variable" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47540" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" }, { "category": "impact", "date": "2026-06-12T13:04:47.777374Z", "details": "Not affected: CVE-2024-47540 targets the Matroska/WebM demuxer (matroska-demux.c, gst_matroska_demux_add_wvpk_header) in the gst-plugins-good module, and the upstream fix and all vendor advisories apply specifically to gst-plugins-good releases prior to 1.24.10. The stated project here is gstreamer1-plugins-base 1.10.4, which does not ship the Matroska/WebM demuxer, so the vulnerable code path is not present or reachable in this environment.", "product_ids": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] }, { "category": "impact", "date": "2026-06-12T13:04:47.777374Z", "details": "Not affected: In gstreamer1-plugins-good 1.10.4, gst_matroska_demux_add_wvpk_header initializes GstMapInfo via gst_buffer_map before any gst_buffer_unmap call, so the uninitialized-map unmap condition required by CVE-2024-47540 is not reachable. The faulty code path that unmaps an uninitialized GstMapInfo was introduced in later releases and fixed in 1.24.10. Therefore, version 1.10.4 does not contain the vulnerable behavior described by this CVE.", "product_ids": [ "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] } ] } ] }