CVE-2024-47545

MEDIUM Year: 2024
CVSS v3 Score
7.5
High
Weakness Type
CWE-191
View all →

Vulnerability Description

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.

Related Vulnerabilities

CVE-2004-0816

HIGH
CVSS:7.5(High)

Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.

CWE-1912004

CVE-2004-1002

HIGH
CVSS:7.5(High)

Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incor...

CWE-1912004

CVE-2005-1891

HIGH
CVSS:7.5(High)

The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underf...

CWE-1912005

CVE-2011-1770

HIGH
CVSS:7.5(High)

Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Pr...

CWE-1912011

CVE-2017-14496

HIGH
CVSS:7.5(High)

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service v...

CWE-1912017

CVE-2018-12230

HIGH
CVSS:7.5(High)

An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 token, allows the attacker to steal tokens or conduct resultant ...

CWE-1912018