CVE-2025-47219

HIGH8.1EPSS 0.44%

發布日:2025/8/7修改日:2026/5/13

描述

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

受影響套件(4)

Bitnami/javafrom 0, < 1.8.0, >= 1.9.0, < 8.0.481
Bitnami/java-minfrom 0, < 1.8.0, >= 1.9.0, < 8.0.481
Bitnami/jrefrom 0, < 1.8.0, >= 1.9.0, < 8.0.481
Debian/gst-plugins-good1.0from 0, < 1.18.4-2+deb11u4

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-47219
WEBhttps://cert-portal.siemens.com/productcert/html/ssa-032379.html
WEBhttps://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
WEBhttps://gstreamer.freedesktop.org/security/
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2025-47219