GStreamer < 1.28.4 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(326245);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/10");

  script_cve_id(
    "CVE-2026-53703",
    "CVE-2026-53704",
    "CVE-2026-53705"
  );
  script_xref(name:"IAVA", value:"2026-A-0673");

  script_name(english:"GStreamer < 1.28.4 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of GStreamer installed on the remote host is prior to 1.28.4. It is, therefore, affected by
multiple vulnerabilities:

  - Multiple vulnerabilities were found in the RealMedia demuxer (rmdemux) and RealAudio demuxer (rademux)
    elements in gst-plugins-ugly. The demuxers lacked proper bounds validation when parsing file headers,
    stream properties, and audio packets, allowing out-of-bounds reads beyond the boundaries of the provided
    data buffers. Additionally, the use of signed integer types for size and length parameters could lead to
    integer overflows during size calculations and index operations. A malicious third party could trigger
    out-of-bounds reads or integer overflows by providing a crafted RealMedia file, potentially resulting in
    a crash, denial of service, or information disclosure. (CVE-2026-53703, CVE-2026-53704)

  - A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially
    crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels)
    in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes
    decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects
    both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to
    the allocation size type. A remote attacker could use this flaw to crash an application or potentially
    execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://gstreamer.freedesktop.org/security/sa-2026-0035.html");
  script_set_attribute(attribute:"see_also", value:"https://gstreamer.freedesktop.org/security/sa-2026-0042.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to GStreamer version 1.28.4, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53705");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:gstreamer:gstreamer");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macos_gstreamer_installed.nbin", "gstreamer_win_installed.nbin");
  script_require_ports("installed_sw/gstreamer", "installed_sw/GStreamer");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'gstreamer', 'type': 'app'},
      'requires': [ {'scope': 'target', 'match': {'os': 'macos' } } ],
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '1.28.4'
        }
      ]
    },
    {
      'product': {'name': 'GStreamer', 'type': 'app'},
      'requires': [ {'scope': 'target', 'match': {'os': 'windows' } } ],
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '1.28.4'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);