CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792239628)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792239628 advisory. - A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd...

CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. W...

CLSA-2026-1792533291 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.7.el79 - the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 qtmoovrecover: validate box sizes, CVE-2026-18298 gdkpixbufdec: handle format and resolution changes correctly and CVE-2026-18299 rtpsbcdepay: check that enough data is available in the...

CLSA-2026-1792238729 gstreamer1-plugins-good: Fix of 4 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1792572593 gstreamer1-plugins-good: Fix of 3 CVEs

CVE-2026-46469: avoid division by zero in qtdemuxparsetrak when zero audio channels are signalled - CVE-2026-46470: avoid division by zero in qtdemuxaudiocaps when zero audio channels are signalled for raw LPCM - CVE-2026-1940: fix out-of-bounds read in gstwavparseadtlchunk on odd-sized adtl...

CLSA-2026-1792532987 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.7.el79 - the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 qtmoovrecover: validate box sizes, CVE-2026-18298 gdkpixbufdec: handle format and resolution changes correctly and CVE-2026-18299 rtpsbcdepay: check that enough data is available in the...

CLSA-2026-1792021687 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.5.el79 - the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gstopusdecparseheader overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is...

CVE-2026-46472

A flaw was found in gstreamer1-plugins-good. When processing a crafted MP4 media file, the isomp4 plugin's qtdemuxparsechnl function can read past the boundary of a global array. A remote attacker could exploit this vulnerability by enticing a user or service to process a specially crafted file,...

CVE-2026-46471

A flaw was found in gstreamer1-plugins-good. An out-of-bounds read vulnerability exists in the isomp4 plugin when parsing custom metadata in MP4 files. By tricking a user or service into processing a specially crafted MP4 file, a remote attacker could cause the application to read past the end of...

CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

DEBIAN-CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CVE-2026-46472

An out-of-bounds read vulnerability exists in GStreamer gst-plugins-good before version 1.28.2 . The flaw is located in the isomp4 plugin's qtdemux_parse_chnl function, which may read past the boundary of a global array while parsing a crafted MP4 media file. A remote attacker could exploit this ...

CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

EUVD-2026-102937

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CVE-2026-46471: Buffer Over-read

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

CVE-2026-46471

A vulnerability exists in GStreamer gst-plugins-good before version 1.28.2 . While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may perform an out-of-bounds read past the end of a heap-allocated buffer. This occurs when processing custom metadata, potentially allowing an a...