CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792239628)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792239628 advisory. - A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.2:CLSA-2026:1792769449)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792769449 advisory. - An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemuxaudiocaps...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792533291)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792533291 advisory. - GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

CLSA-2026-1792533291 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.7.el79 - the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 qtmoovrecover: validate box sizes, CVE-2026-18298 gdkpixbufdec: handle format and resolution changes correctly and CVE-2026-18299 rtpsbcdepay: check that enough data is available in the...

CLSA-2026-1792238729 gstreamer1-plugins-good: Fix of 4 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1792572593 gstreamer1-plugins-good: Fix of 3 CVEs

CVE-2026-46469: avoid division by zero in qtdemuxparsetrak when zero audio channels are signalled - CVE-2026-46470: avoid division by zero in qtdemuxaudiocaps when zero audio channels are signalled for raw LPCM - CVE-2026-1940: fix out-of-bounds read in gstwavparseadtlchunk on odd-sized adtl...

CLSA-2026-1792532772 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.7.el79 - the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 qtmoovrecover: validate box sizes, CVE-2026-18298 gdkpixbufdec: handle format and resolution changes correctly and CVE-2026-18299 rtpsbcdepay: check that enough data is available in the...

CLSA-2026-1792532987 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.7.el79 - the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 qtmoovrecover: validate box sizes, CVE-2026-18298 gdkpixbufdec: handle format and resolution changes correctly and CVE-2026-18299 rtpsbcdepay: check that enough data is available in the...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792572593)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792572593 advisory. - An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792572593)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792572593 advisory. - An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792021687)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792021687 advisory. - GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been...

SUSE CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

SUSE CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CLSA-2026-1792255236 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1792021687 gstreamer1-plugins-good: Fix of 4 CVEs

rebase onto Oracle 1.10.4-2.0.5.el79 - the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613. Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the gstopusdecparseheader overflow in gst-plugins-base; the patch carries upstream f8e398c4, which is...

CVE-2026-46472

A flaw was found in gstreamer1-plugins-good. When processing a crafted MP4 media file, the isomp4 plugin's qtdemuxparsechnl function can read past the boundary of a global array. A remote attacker could exploit this vulnerability by enticing a user or service to process a specially crafted file,...

CVE-2026-46471

A flaw was found in gstreamer1-plugins-good. An out-of-bounds read vulnerability exists in the isomp4 plugin when parsing custom metadata in MP4 files. By tricking a user or service into processing a specially crafted MP4 file, a remote attacker could cause the application to read past the end of...

CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

ALPINE-CVE-2026-46472

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

DEBIAN-CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...