The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5831 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5831-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 14, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     CVE ID         : CVE-2024-47538 CVE-2024-47541 CVE-2024-47600                      CVE-2024-47607 CVE-2024-47615 CVE-2024-47835

    Multiple multiple vulnerabilities were discovered in plugins for the     GStreamer media framework and its codecs and demuxers, which may result     in denial of service or potentially the execution of arbitrary code if     a malformed media file is opened.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.22.0-3+deb12u3.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7175-1 advisory.

    Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files.
    An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of     service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0065-1 advisory.

    - CVE-2024-47538: Fixed a stack-buffer overflow in vorbis_handle_identification_packet. (bsc#1234415)
    - CVE-2024-47835: Fixed a NULL-pointer dereference in LRC subtitle parser. (bsc#1234450)
    - CVE-2024-47600: Fixed an out-of-bounds read in gst-discoverer-1.0 commandline tool. (bsc#1234453)
    - CVE-2024-47615: Fixed an out-of-bounds write in Ogg demuxer. (bsc#1234456)
    - CVE-2024-47541: Fixed an out-of-bounds write in SSA subtitle parser. (bsc#1234459)
    - CVE-2024-47542: Fixed an ID3v2 parser out-of-bounds read and NULL-pointer dereference. (bsc#1234460)
    - CVE-2024-47607: Fixed a stack buffer-overflow in Opus decoder. (bsc#1234455)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7243 advisory.

    * gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)
      * gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)
      * gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)
      * gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202506-02 (GStreamer, GStreamer Plugins: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE     identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
213023	Debian dsa-5831 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	12/14/2024	5/5/2025	high
213188	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GStreamer Base Plugins vulnerabilities (USN-7175-1)	Nessus	Ubuntu Local Security Checks	12/18/2024	5/5/2025	high
213964	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gstreamer-plugins-base (SUSE-SU-2025:0065-1)	Nessus	SuSE Local Security Checks	1/11/2025	1/11/2025	high
241259	AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2025:7243)	Nessus	Alma Linux Local Security Checks	7/3/2025	7/3/2025	medium
240464	GLSA-202506-02 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	6/25/2025	6/25/2025	high

Detections

Analytics

Plugins Search

high

high

high

medium

high