{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n Patch1007 protects the dec_data allocation but leaves the output-buffer size\n computed in 32-bit arithmetic on this branch, because upstream's fix relies\n on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no\n i686 buildroot can satisfy and which would split the generated documentation\n between architectures\n- require gstreamer1-plugins-base >= 1.10.4-2.0.3, the first of our builds in\n which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n tests", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1792021687.json" } ], "tracking": { "current_release_date": "2026-10-20T16:08:14Z", "generator": { "date": "2026-10-20T16:08:14Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792021687", "initial_release_date": "2026-10-14T23:48:08Z", "revision_history": [ { "date": "2026-10-14T23:48:08Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-20T16:08:14Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "gstreamer1-plugins-good: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.0.5.el7.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.0.5.el7.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.0.5.el7.tuxcare.els1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-47606", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47606" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250418-0003/", "url": "https://security.netapp.com/advisory/ntap-20250418-0003/" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T23:48:08.688622Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687", "product_ids": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-47540", "cwe": { "id": "CWE-457", "name": "Use of Uninitialized Variable" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47540" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T23:48:08.688622Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687", "product_ids": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53705", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53705" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36675", "url": "https://access.redhat.com/errata/RHSA-2026:36675" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36774", "url": "https://access.redhat.com/errata/RHSA-2026:36774" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37129", "url": "https://access.redhat.com/errata/RHSA-2026:37129" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47032", "url": "https://access.redhat.com/errata/RHSA-2026:47032" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47050", "url": "https://access.redhat.com/errata/RHSA-2026:47050" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47051", "url": "https://access.redhat.com/errata/RHSA-2026:47051" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47052", "url": "https://access.redhat.com/errata/RHSA-2026:47052" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47174", "url": "https://access.redhat.com/errata/RHSA-2026:47174" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49602", "url": "https://access.redhat.com/errata/RHSA-2026:49602" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49603", "url": "https://access.redhat.com/errata/RHSA-2026:49603" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49604", "url": "https://access.redhat.com/errata/RHSA-2026:49604" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53705", "url": "https://access.redhat.com/security/cve/CVE-2026-53705" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json" } ], "release_date": "2026-06-15T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T23:48:08.688622Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687", "product_ids": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-47613", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47613" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T23:48:08.688622Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687", "product_ids": [ "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.aarch64", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.i686", "CentOS-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792021687" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }