gstreamer1-plugins-base security update

1.26.7-2.2 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves: RHEL-253746...

PT-2026-90045

Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon allows remote unauthenticated attackers to access live H.264 vid...

CVE-2026-79394: Initialization of a Resource with an Insecure Default

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

RockyLinux 10 : gstreamer1-plugins-base (RLSA-2026:66460)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66460 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

Oracle Linux 10 : ELSA-2026-66460-0: / gstreamer1-plugins-base (ELSA-2026-664600)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-664600 advisory. 1.26.7-2.2 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves: RHEL-253746 Tenable has extracted the preceding description block directly fr...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

EUVD-2026-76190

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

RHEL 10 : gstreamer1-plugins-base (RHSA-2026:66460)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66460 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

CVE-2026-38998

A flaw was found in LIVE555 Streaming Media. This use-after-free vulnerability allows a remote attacker to cause a Denial of Service DoS. By sending a series of specially crafted Real-Time Streaming Protocol RTSP and Hypertext Transfer Protocol HTTP requests, an attacker can trigger the flaw,...

ALSA-2026:66460 Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

Linux Distros Unpatched Vulnerability : CVE-2026-73324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controll...

CVE-2026-38998

A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...

UBUNTU-CVE-2026-38998

A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...

CVE-2026-73324

A flaw was found in VLC media player. A remote attacker operating a hostile server can exploit a heap out-of-bounds read vulnerability. This occurs when the media player processes an unterminated Real Time Streaming Protocol RTSP response line, causing it to read beyond the allocated buffer...

CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

DEBIAN-CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

UBUNTU-CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

EUVD-2026-74907

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long...