CVE-2024-47542: 
NixOS vulnerability analysis and mitigation

GStreamer, a library for constructing graphs of media-handling components, was found to contain a null pointer dereference vulnerability (CVE-2024-47542) in the id3v2readsynchuint function located in id3v2.c. The vulnerability was discovered on September 26, 2024, and was fixed in version 1.24.10 ([GitHub Advisory](https://securitylab.github.com/advisories/GHSL-2024-235Gstreamer/), GStreamer Advisory).

The vulnerability occurs when id3v2readsynchuint is called with a null work->hdr.framedata, causing the pointer guint8 *data to be accessed without proper validation. This results in a null pointer dereference. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can result in a Denial of Service (DoS) condition by triggering a segmentation fault (SEGV), causing the application to crash (GitHub Advisory).

The vulnerability has been fixed in GStreamer version 1.24.10. Users are advised to upgrade to this version or apply the available security patch. Various Linux distributions have also released updated packages to address this vulnerability (GStreamer Advisory).