ALAS2-2025-3003

Amazon Linux 2 Security Advisory: ALAS2-2025-3003
Advisory Released Date: 2025-09-16
Advisory Updated Date: 2025-09-16
Severity: Medium
Issue Overview:

GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10. (CVE-2024-47544)

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure. (CVE-2025-47183)

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure. (CVE-2025-47219)


Affected Packages:

gstreamer1-plugins-good


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update gstreamer1-plugins-good or yum update --advisory ALAS2-2025-3003 to update your system.

New Packages:
aarch64:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.8.aarch64
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.8.aarch64
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.8.aarch64

i686:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.8.i686
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.8.i686
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.8.i686

src:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.8.src

x86_64:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.8.x86_64
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.8.x86_64
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.8.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2024-47544, CVE-2025-47183, CVE-2025-47219

Mitre: CVE-2024-47544, CVE-2025-47183, CVE-2025-47219