CVE-2024-47603: 
NixOS vulnerability analysis and mitigation

GStreamer, a library for constructing graphs of media-handling components, contains a null pointer dereference vulnerability (CVE-2024-47603) discovered in the gstmatroskademuxupdatetracks function within matroska-demux.c. The vulnerability was identified on December 11, 2024, and affects versions prior to 1.24.10 (NVD, GitHub Advisory).

The vulnerability occurs when the gstcapsisequal function is called with invalid caps values. In the function gstbuffergetsize, the call to GSTBUFFERMEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV) when processing certain input files, potentially causing the application to crash (GitHub Advisory).

The vulnerability has been fixed in GStreamer version 1.24.10. Users are advised to upgrade to this version. For those using older branches of GStreamer, applying and recompiling with the provided patch is recommended (GStreamer Advisory).