

# Security update for gstreamer-plugins-good

Announcement ID: SUSE-SU-2025:0055-1  
Release Date: 2025-01-09T16:37:03Z  
Rating: important  
References:

  * bsc#1234414
  * bsc#1234417
  * bsc#1234421
  * bsc#1234424
  * bsc#1234425
  * bsc#1234426
  * bsc#1234427
  * bsc#1234428
  * bsc#1234432
  * bsc#1234433
  * bsc#1234434
  * bsc#1234435
  * bsc#1234436
  * bsc#1234439
  * bsc#1234440
  * bsc#1234446
  * bsc#1234447
  * bsc#1234449
  * bsc#1234462
  * bsc#1234473
  * bsc#1234476
  * bsc#1234477

  
Cross-References:

  * CVE-2024-47530
  * CVE-2024-47537
  * CVE-2024-47539
  * CVE-2024-47543
  * CVE-2024-47544
  * CVE-2024-47545
  * CVE-2024-47546
  * CVE-2024-47596
  * CVE-2024-47597
  * CVE-2024-47598
  * CVE-2024-47599
  * CVE-2024-47601
  * CVE-2024-47602
  * CVE-2024-47603
  * CVE-2024-47606
  * CVE-2024-47613
  * CVE-2024-47774
  * CVE-2024-47775
  * CVE-2024-47776
  * CVE-2024-47777
  * CVE-2024-47778
  * CVE-2024-47834

  
CVSS scores:

  * CVE-2024-47530 ( NVD ):  5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
  * CVE-2024-47530 ( NVD ):  6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2024-47537 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47537 ( NVD ):  8.6
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47537 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47539 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47539 ( NVD ):  8.6
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47539 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47543 ( SUSE ):  6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2024-47543 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47543 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47544 ( SUSE ):  6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47544 ( NVD ):  6.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47544 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47545 ( SUSE ):  6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47545 ( NVD ):  6.9
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47545 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47546 ( SUSE ):  6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47546 ( NVD ):  6.9
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47546 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47596 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47596 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47596 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47597 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47597 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47597 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47598 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47598 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47598 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47599 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47599 ( NVD ):  6.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47599 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47601 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47601 ( NVD ):  6.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47601 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47602 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47602 ( NVD ):  6.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47602 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47603 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47603 ( NVD ):  6.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47603 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47606 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47606 ( NVD ):  8.6
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47606 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47613 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47613 ( NVD ):  8.6
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47613 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-47774 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47774 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47774 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47775 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47775 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47775 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47776 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47776 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47776 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47777 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47777 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47777 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2024-47778 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47778 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47778 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47834 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-47834 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-47834 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  
Affected Products:

  * Basesystem Module 15-SP6
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP6
  * SUSE Linux Enterprise Real Time 15 SP6
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Workstation Extension 15 SP6

  
  
An update that solves 22 vulnerabilities can now be installed.

## Description:

This update for gstreamer-plugins-good fixes the following issues:

  * CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory
    allocator that can lead to out-of-bounds writes. (boo#1234449)
  * CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c.
    (boo#1234414)
  * CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a.
    (boo#1234417)
  * CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM
    demuxer. (boo#1234421)
  * CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead
    to out-of-bounds reads. (boo#1234424)
  * CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table
    parser (boo#1234425)
  * CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read.
    (boo#1234426)
  * CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can
    lead to NULL-pointer dereferences. (boo#1234427)
  * CVE-2024-47601: Fixed a NULL-pointer dereference in Matroska/WebM demuxer.
    (boo#1234428)
  * CVE-2024-47602: Fixed a NULL-pointer dereferences and out-of-bounds reads in
    Matroska/WebM demuxer. (boo#1234432)
  * CVE-2024-47603: Fixed a NULL-pointer dereference in Matroska/WebM demuxer.
    (boo#1234433)
  * CVE-2024-47775: Fixed various out-of-bounds reads in WAV parser.
    (boo#1234434)
  * CVE-2024-47776: Fixed various out-of-bounds reads in WAV parser.
    (boo#1234435)
  * CVE-2024-47777: Fixed various out-of-bounds reads in WAV parser.
    (boo#1234436)
  * CVE-2024-47778: Fixed various out-of-bounds reads in WAV parser.
    (boo#1234439)
  * CVE-2024-47834: Fixed a use-after-free in the Matroska demuxer that can
    cause crashes for certain input files. (boo#1234440)
  * CVE-2024-47774: Fixed an integer overflow in AVI subtitle parser that leads
    to out-of-bounds reads. (boo#1234446)
  * CVE-2024-47613: Fixed a NULL-pointer dereference in gdk-pixbuf decoder.
    (boo#1234447)
  * CVE-2024-47543: Fixed an out-of-bounds write in qtdemux_parse_container.
    (boo#1234462)
  * CVE-2024-47544: Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC
    handling. (boo#1234473)
  * CVE-2024-47545: Fixed an integer underflow in FOURCC_strf parsing leading to
    out-of-bounds read. (boo#1234476)
  * CVE-2024-47546: Fixed an integer underflow in extract_cc_from_data leading
    to out-of-bounds read. (boo#1234477)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * openSUSE Leap 15.6  
    zypper in -t patch SUSE-2025-55=1 openSUSE-SLE-15.6-2025-55=1

  * Basesystem Module 15-SP6  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-55=1

  * SUSE Linux Enterprise Workstation Extension 15 SP6  
    zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-55=1

## Package List:

  * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
    * gstreamer-plugins-good-qtqml-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-qtqml-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-gtk-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-gtk-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-1.24.0-150600.3.3.1
  * openSUSE Leap 15.6 (x86_64)
    * gstreamer-plugins-good-32bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-32bit-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-32bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-32bit-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-32bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-32bit-debuginfo-1.24.0-150600.3.3.1
  * openSUSE Leap 15.6 (noarch)
    * gstreamer-plugins-good-lang-1.24.0-150600.3.3.1
  * openSUSE Leap 15.6 (aarch64_ilp32)
    * gstreamer-plugins-good-64bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-64bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-64bit-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-64bit-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-jack-64bit-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-extra-64bit-debuginfo-1.24.0-150600.3.3.1
  * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
    * gstreamer-plugins-good-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1
  * Basesystem Module 15-SP6 (noarch)
    * gstreamer-plugins-good-lang-1.24.0-150600.3.3.1
  * SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
    * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-gtk-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1
    * gstreamer-plugins-good-gtk-debuginfo-1.24.0-150600.3.3.1

## References:

  * https://www.suse.com/security/cve/CVE-2024-47530.html
  * https://www.suse.com/security/cve/CVE-2024-47537.html
  * https://www.suse.com/security/cve/CVE-2024-47539.html
  * https://www.suse.com/security/cve/CVE-2024-47543.html
  * https://www.suse.com/security/cve/CVE-2024-47544.html
  * https://www.suse.com/security/cve/CVE-2024-47545.html
  * https://www.suse.com/security/cve/CVE-2024-47546.html
  * https://www.suse.com/security/cve/CVE-2024-47596.html
  * https://www.suse.com/security/cve/CVE-2024-47597.html
  * https://www.suse.com/security/cve/CVE-2024-47598.html
  * https://www.suse.com/security/cve/CVE-2024-47599.html
  * https://www.suse.com/security/cve/CVE-2024-47601.html
  * https://www.suse.com/security/cve/CVE-2024-47602.html
  * https://www.suse.com/security/cve/CVE-2024-47603.html
  * https://www.suse.com/security/cve/CVE-2024-47606.html
  * https://www.suse.com/security/cve/CVE-2024-47613.html
  * https://www.suse.com/security/cve/CVE-2024-47774.html
  * https://www.suse.com/security/cve/CVE-2024-47775.html
  * https://www.suse.com/security/cve/CVE-2024-47776.html
  * https://www.suse.com/security/cve/CVE-2024-47777.html
  * https://www.suse.com/security/cve/CVE-2024-47778.html
  * https://www.suse.com/security/cve/CVE-2024-47834.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1234414
  * https://bugzilla.suse.com/show_bug.cgi?id=1234417
  * https://bugzilla.suse.com/show_bug.cgi?id=1234421
  * https://bugzilla.suse.com/show_bug.cgi?id=1234424
  * https://bugzilla.suse.com/show_bug.cgi?id=1234425
  * https://bugzilla.suse.com/show_bug.cgi?id=1234426
  * https://bugzilla.suse.com/show_bug.cgi?id=1234427
  * https://bugzilla.suse.com/show_bug.cgi?id=1234428
  * https://bugzilla.suse.com/show_bug.cgi?id=1234432
  * https://bugzilla.suse.com/show_bug.cgi?id=1234433
  * https://bugzilla.suse.com/show_bug.cgi?id=1234434
  * https://bugzilla.suse.com/show_bug.cgi?id=1234435
  * https://bugzilla.suse.com/show_bug.cgi?id=1234436
  * https://bugzilla.suse.com/show_bug.cgi?id=1234439
  * https://bugzilla.suse.com/show_bug.cgi?id=1234440
  * https://bugzilla.suse.com/show_bug.cgi?id=1234446
  * https://bugzilla.suse.com/show_bug.cgi?id=1234447
  * https://bugzilla.suse.com/show_bug.cgi?id=1234449
  * https://bugzilla.suse.com/show_bug.cgi?id=1234462
  * https://bugzilla.suse.com/show_bug.cgi?id=1234473
  * https://bugzilla.suse.com/show_bug.cgi?id=1234476
  * https://bugzilla.suse.com/show_bug.cgi?id=1234477

openSUSE: 2025:0055-1 important: gstreamer-plugins-good Advisory Security Update

January 9, 2025

Description

This update for gstreamer-plugins-good fixes the following issues: * CVE-2024-47606: Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. (boo#1234449) * CVE-2024-47537: Fixed an out-of-bounds write in isomp4/qtdemux.c. (boo#1234414) * CVE-2024-47539: Fixed an out-of-bounds write in convert_to_s334_1a. (boo#1234417) * CVE-2024-47530: Fixed an uninitialized stack memory in Matroska/WebM demuxer. (boo#1234421) * CVE-2024-47596: Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. (boo#1234424) * CVE-2024-47597: Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser (boo#1234425) * CVE-2024-47598: Fixed MP4/MOV sample table parser out-of-bounds read. (boo#1234426) * CVE-2024-47599: Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. (boo#1234427) * CVE-2024-47601: Fixed a NULL-pointer dereference in ...

Read the Full Advisory

Patch

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-55=1 openSUSE-SLE-15.6-2025-55=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-55=1 * SUSE Linux Enterprise Workstation Extension 15 SP6 zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-55=1

Package List

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * gstreamer-plugins-good-qtqml-1.24.0-150600.3.3.1 * gstreamer-plugins-good-qtqml-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-1.24.0-150600.3.3.1 * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-1.24.0-150600.3.3.1 * gstreamer-plugins-good-gtk-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-gtk-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-1.24.0-150600.3.3.1 * openSUSE Leap 15.6 (x86_64) * gstreamer-plugins-good-32bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-32bit-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-32bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-32bit-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-32bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-32bit-debuginfo-1.24.0-150600.3.3.1 * openSUSE Leap 15.6 (noarch) * gstreamer-plugins-good-lang-1.24.0-150600.3.3.1 * openSUSE Leap 15.6 (aarch64_ilp32) * gstreamer-plugins-good-64bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-64bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-64bit-1.24.0-150600.3.3.1 * gstreamer-plugins-good-64bit-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-jack-64bit-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-extra-64bit-debuginfo-1.24.0-150600.3.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * gstreamer-plugins-good-1.24.0-150600.3.3.1 * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1 * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1 * Basesystem Module 15-SP6 (noarch) * gstreamer-plugins-good-lang-1.24.0-150600.3.3.1 * SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64) * gstreamer-plugins-good-debugsource-1.24.0-150600.3.3.1 * gstreamer-plugins-good-gtk-1.24.0-150600.3.3.1 * gstreamer-plugins-good-debuginfo-1.24.0-150600.3.3.1 * gstreamer-plugins-good-gtk-debuginfo-1.24.0-150600.3.3.1

References

* bsc#1234414 * bsc#1234417 * bsc#1234421 * bsc#1234424 * bsc#1234425 * bsc#1234426 * bsc#1234427 * bsc#1234428 * bsc#1234432 * bsc#1234433 * bsc#1234434 * bsc#1234435 * bsc#1234436 * bsc#1234439 * bsc#1234440 * bsc#1234446 * bsc#1234447 * bsc#1234449 * bsc#1234462 * bsc#1234473 * bsc#1234476 * bsc#1234477 ## References: * https://www.suse.com/security/cve/CVE-2024-47530.html * https://www.suse.com/security/cve/CVE-2024-47537.html * https://www.suse.com/security/cve/CVE-2024-47539.html * https://www.suse.com/security/cve/CVE-2024-47543.html * https://www.suse.com/security/cve/CVE-2024-47544.html * https://www.suse.com/security/cve/CVE-2024-47545.html * https://www.suse.com/security/cve/CVE-2024-47546.html * https://www.suse.com/security/cve/CVE-2024-47596.html * https://www.suse.com/security/cve/CVE-2024-47597.html * https://www.suse.com/security/cve/CVE-2024-47598.html * https://www.suse.com/security/cve/CVE-2024-47599.html * https://www.suse.com/security/cve/CVE-2024-47601.html * https://www.suse.com/security/cve/CVE-2024-47602.html * https://www.suse.com/security/cve/CVE-2024-47603.html * https://www.suse.com/security/cve/CVE-2024-47606.html * https://www.suse.com/security/cve/CVE-2024-47613.html * https://www.suse.com/security/cve/CVE-2024-47774.html * https://www.suse.com/security/cve/CVE-2024-47775.html * https://www.suse.com/security/cve/CVE-2024-47776.html * https://www.suse.com/security/cve/CVE-2024-47777.html * https://www.suse.com/security/cve/CVE-2024-47778.html * https://www.suse.com/security/cve/CVE-2024-47834.html * https://bugzilla.suse.com/show_bug.cgi?id=1234414 * https://bugzilla.suse.com/show_bug.cgi?id=1234417 * https://bugzilla.suse.com/show_bug.cgi?id=1234421 * https://bugzilla.suse.com/show_bug.cgi?id=1234424 * https://bugzilla.suse.com/show_bug.cgi?id=1234425 * https://bugzilla.suse.com/show_bug.cgi?id=1234426 * https://bugzilla.suse.com/show_bug.cgi?id=1234427 * https://bugzilla.suse.com/show_bug.cgi?id=1234428 * https://bugzilla.suse.com/show_bug.cgi?id=1234432 * https://bugzilla.suse.com/show_bug.cgi?id=1234433 * https://bugzilla.suse.com/show_bug.cgi?id=1234434 * https://bugzilla.suse.com/show_bug.cgi?id=1234435 * https://bugzilla.suse.com/show_bug.cgi?id=1234436 * https://bugzilla.suse.com/show_bug.cgi?id=1234439 * https://bugzilla.suse.com/show_bug.cgi?id=1234440 * https://bugzilla.suse.com/show_bug.cgi?id=1234446 * https://bugzilla.suse.com/show_bug.cgi?id=1234447 * https://bugzilla.suse.com/show_bug.cgi?id=1234449 * https://bugzilla.suse.com/show_bug.cgi?id=1234462 * https://bugzilla.suse.com/show_bug.cgi?id=1234473 * https://bugzilla.suse.com/show_bug.cgi?id=1234476 * https://bugzilla.suse.com/show_bug.cgi?id=1234477

Severity

Announcement ID: SUSE-SU-2025:0055-1

Release Date: 2025-01-09T16:37:03Z

Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Workstation Extension 15 SP6 An update that solves 22 vulnerabilities can now be installed.