{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/vex/2024/cve-2024-47613-els_os-oraclelinux7els.json" } ], "tracking": { "current_release_date": "2026-07-23T22:52:38Z", "generator": { "date": "2026-07-23T22:52:38Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-47613-ELS_OS-ORACLELINUX7ELS", "initial_release_date": "2024-12-12T02:03:00Z", "revision_history": [ { "date": "2024-12-12T02:03:00Z", "number": "1", "summary": "Initial version" }, { "date": "2025-11-29T11:00:43Z", "number": "2", "summary": "Official Publication" }, { "date": "2025-12-23T22:15:38Z", "number": "3", "summary": "Update document" }, { "date": "2026-06-13T01:48:10Z", "number": "4", "summary": "Update document" }, { "date": "2026-07-23T22:52:38Z", "number": "5", "summary": "Update document" } ], "status": "final", "version": "5" }, "title": "Security update on CVE-2024-47613" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 7", "product": { "name": "Oracle Linux 7", "product_id": "Oracle-Linux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.el7.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.el7.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els3?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-tools@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.el7.tuxcare.els3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product_id": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel-docs@1.10.4-2.el7.tuxcare.els3?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch" }, "product_reference": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64", "relates_to_product_reference": "Oracle-Linux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-47613", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47613" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" }, { "category": "impact", "date": "2026-06-12T13:04:47.777374Z", "details": "Not vulnerable: CVE-2024-47613 affects the GdkPixbuf image decoder element (gdkpixbufdec) implemented in gst-plugins-good; the vulnerable function gst_gdk_pixbuf_dec_flush resides in ext/gdk_pixbuf/gstgdkpixbufdec.c within that module. The gstreamer1-plugins-base package (including 1.10.4) does not include this decoder, so the affected code is not present or reachable. Therefore, this CVE does not apply to gstreamer1-plugins-base in this environment.", "product_ids": [ "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-base-devel-0:1.10.4-2.el7.tuxcare.els3.x86_64", "Oracle-Linux-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.el7.tuxcare.els3.noarch", "Oracle-Linux-7:gstreamer1-plugins-base-tools-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] }, { "category": "impact", "date": "2026-06-12T13:04:47.777374Z", "details": "Not vulnerable. The crash requires newer GStreamer branches where gst_video_info_set_format() may fail for invalid width/height and leave GstVideoInfo uninitialized; in gstreamer1-plugins-good 1.10.4 this function does not early-return and fill_planes() is executed, ensuring the info struct is valid and out_pix is never NULL. As a result, the memcpy-based NULL dereference path in gst_gdk_pixbuf_dec_flush is not reachable on version 1.10.4.", "product_ids": [ "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els1.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els2.x86_64", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.i686", "Oracle-Linux-7:gstreamer1-plugins-good-0:1.10.4-2.el7.tuxcare.els3.x86_64" ] } ] } ] }