{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds\n access when parsing FUJIFILM metadata in strd chunks\n- CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor\n when counting vprp video field descriptors", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/advisories/2026/clsa-2026_1792255236.json" } ], "tracking": { "current_release_date": "2026-10-26T16:46:45Z", "generator": { "date": "2026-10-26T16:46:45Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792255236", "initial_release_date": "2026-10-17T16:41:24Z", "revision_history": [ { "date": "2026-10-17T16:41:24Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-26T16:46:45Z", "number": "2", "summary": "Update document" } ], "status": "final", "version": "2" }, "title": "gstreamer1-plugins-good: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.0.5.el7.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "product": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "product_id": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-good@1.10.4-2.0.5.el7.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3085", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-3085" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf" }, { "category": "external", "summary": "https://www.zerodayinitiative.com/advisories/ZDI-26-167/", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-167/" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19024", "url": "https://access.redhat.com/errata/RHSA-2026:19024" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19180", "url": "https://access.redhat.com/errata/RHSA-2026:19180" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6259", "url": "https://access.redhat.com/errata/RHSA-2026:6259" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6300", "url": "https://access.redhat.com/errata/RHSA-2026:6300" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6750", "url": "https://access.redhat.com/errata/RHSA-2026:6750" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7673", "url": "https://access.redhat.com/errata/RHSA-2026:7673" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7850", "url": "https://access.redhat.com/errata/RHSA-2026:7850" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8854", "url": "https://access.redhat.com/errata/RHSA-2026:8854" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8857", "url": "https://access.redhat.com/errata/RHSA-2026:8857" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8862", "url": "https://access.redhat.com/errata/RHSA-2026:8862" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8874", "url": "https://access.redhat.com/errata/RHSA-2026:8874" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8876", "url": "https://access.redhat.com/errata/RHSA-2026:8876" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9446", "url": "https://access.redhat.com/errata/RHSA-2026:9446" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9447", "url": "https://access.redhat.com/errata/RHSA-2026:9447" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9487", "url": "https://access.redhat.com/errata/RHSA-2026:9487" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9488", "url": "https://access.redhat.com/errata/RHSA-2026:9488" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-3085", "url": "https://access.redhat.com/security/cve/CVE-2026-3085" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447495" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3085.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3085.json" } ], "release_date": "2026-03-16T14:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-47606", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47606" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0014.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250418-0003/", "url": "https://security.netapp.com/advisory/ntap-20250418-0003/" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-73433", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73433" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:55434", "url": "https://access.redhat.com/errata/RHSA-2026:55434" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:55436", "url": "https://access.redhat.com/errata/RHSA-2026:55436" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:56966", "url": "https://access.redhat.com/errata/RHSA-2026:56966" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:65959", "url": "https://access.redhat.com/errata/RHSA-2026:65959" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68642", "url": "https://access.redhat.com/errata/RHSA-2026:68642" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68644", "url": "https://access.redhat.com/errata/RHSA-2026:68644" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68645", "url": "https://access.redhat.com/errata/RHSA-2026:68645" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:69232", "url": "https://access.redhat.com/errata/RHSA-2026:69232" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70264", "url": "https://access.redhat.com/errata/RHSA-2026:70264" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70584", "url": "https://access.redhat.com/errata/RHSA-2026:70584" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70803", "url": "https://access.redhat.com/errata/RHSA-2026:70803" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-73433", "url": "https://access.redhat.com/security/cve/CVE-2026-73433" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2514801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514801" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html", "url": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html" } ], "release_date": "2026-08-12T20:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-73434", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73434" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:55434", "url": "https://access.redhat.com/errata/RHSA-2026:55434" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:55436", "url": "https://access.redhat.com/errata/RHSA-2026:55436" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:56966", "url": "https://access.redhat.com/errata/RHSA-2026:56966" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:65959", "url": "https://access.redhat.com/errata/RHSA-2026:65959" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68642", "url": "https://access.redhat.com/errata/RHSA-2026:68642" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68644", "url": "https://access.redhat.com/errata/RHSA-2026:68644" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:68645", "url": "https://access.redhat.com/errata/RHSA-2026:68645" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:69232", "url": "https://access.redhat.com/errata/RHSA-2026:69232" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70264", "url": "https://access.redhat.com/errata/RHSA-2026:70264" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70584", "url": "https://access.redhat.com/errata/RHSA-2026:70584" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:70803", "url": "https://access.redhat.com/errata/RHSA-2026:70803" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-73434", "url": "https://access.redhat.com/security/cve/CVE-2026-73434" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2514807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514807" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html", "url": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html" } ], "release_date": "2026-08-12T20:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-47540", "cwe": { "id": "CWE-457", "name": "Use of Uninitialized Variable" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47540" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53705", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53705" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36675", "url": "https://access.redhat.com/errata/RHSA-2026:36675" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36774", "url": "https://access.redhat.com/errata/RHSA-2026:36774" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37129", "url": "https://access.redhat.com/errata/RHSA-2026:37129" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47032", "url": "https://access.redhat.com/errata/RHSA-2026:47032" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47050", "url": "https://access.redhat.com/errata/RHSA-2026:47050" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47051", "url": "https://access.redhat.com/errata/RHSA-2026:47051" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47052", "url": "https://access.redhat.com/errata/RHSA-2026:47052" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47174", "url": "https://access.redhat.com/errata/RHSA-2026:47174" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49602", "url": "https://access.redhat.com/errata/RHSA-2026:49602" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49603", "url": "https://access.redhat.com/errata/RHSA-2026:49603" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49604", "url": "https://access.redhat.com/errata/RHSA-2026:49604" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53705", "url": "https://access.redhat.com/security/cve/CVE-2026-53705" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json" } ], "release_date": "2026-06-15T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-47613", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47613" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0025.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T16:40:38.442984Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.i686", "Red-Hat-7:gstreamer1-plugins-good-0:1.10.4-2.0.5.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792255236" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }