gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update
エラータID: AXSA:2026-421:01
リリース日:
2026/04/13 Monday - 22:16
題名:
gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- GStreamer の ASF Demuxer コンポーネントには、ヒープベースの
バッファオーバーフローの問題があるため、ローカルの攻撃者により、
任意のコードの実行を可能とする脆弱性が存在します。(CVE-2026-2920)
- GStreamer には、整数オーバーフローの問題があるため、ローカルの
攻撃者により、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2026-2921)
- GStreamer の RealMedia Demuxer コンポーネントには、メモリ領域
の範囲外書き込みの問題があるため、ローカルの攻撃者により、任意の
コードの実行を可能とする脆弱性が存在します。(CVE-2026-2922)
- GStreamer には、メモリ領域の範囲外書き込みの問題があるため、
ローカルの攻撃者により、任意のコードの実行を可能とする脆弱性が
存在します。(CVE-2026-2923)
- GStreamer の JPEG 解析処理には、ヒープベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、任意のコードの
実行を可能とする脆弱性が存在します。(CVE-2026-3082)
- GStreamer の rtpqdm2depay エレメントには、メモリ領域の範囲外
書き込みの問題があるため、リモートの攻撃者により、任意のコードの
実行を可能とする脆弱性が存在します。(CVE-2026-3083)
- GStreamer の rtpqdm2depay コンポーネントには、ヒープベースの
バッファオーバーフローの問題があるため、リモートの攻撃者により、
任意のコードの実行可能とする脆弱性が存在します。(CVE-2026-3085)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-2920
GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of stream headers within ASF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28843.
GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of stream headers within ASF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28843.
CVE-2026-2921
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28854.
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28854.
CVE-2026-2922
GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.
GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.
CVE-2026-2923
GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of coordinates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28838.
GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of coordinates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28838.
CVE-2026-3082
GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28840.
GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28840.
CVE-2026-3083
GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid element, the process does not properly validate user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28850.
GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid element, the process does not properly validate user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28850.
CVE-2026-3085
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.
追加情報:
N/A
ダウンロード:
SRPMS
- gstreamer1-plugins-bad-free-1.22.12-5.el9_7.src.rpm
MD5: 0dfaeff63a8643e7de3a5da57b54d5d2
SHA-256: d5f40aa0ddd0dfeb9a422b41b69db536d9132185d84c7bdfefb113df7ea4ab11
Size: 5.32 MB - gstreamer1-plugins-base-1.22.12-5.el9_7.src.rpm
MD5: 5040d487c793ee80e967525d1b2cf4e4
SHA-256: 83983b926c81b9e60e3828f06de866a6aff97f1c6adcf8914393f157946fc218
Size: 2.30 MB - gstreamer1-plugins-good-1.22.12-5.el9_7.src.rpm
MD5: 55c99c694809fde9b52a6ebe3f16e3ea
SHA-256: 0ab97c0de856d6d083ceaea07ac63bf318a8068037989730700bb0987736b785
Size: 2.76 MB - gstreamer1-plugins-ugly-free-1.22.12-4.el9_7.src.rpm
MD5: 6bca2f1b75755c6b74a03eacd4a9174c
SHA-256: a8bf5fa9e2abe405d64042d528f2451c1dd7b757a5f7a76cc876c80b0ebfce58
Size: 266.10 kB
Asianux Server 9 for x86_64
- gstreamer1-plugins-bad-free-1.22.12-5.el9_7.i686.rpm
MD5: a4f2a02915e31170fee8f394da19503f
SHA-256: 64a3d35456be4bb30616d06c0c0e0523bc5d9299d8ecd1eac2ff6f13561af9f4
Size: 2.56 MB - gstreamer1-plugins-bad-free-1.22.12-5.el9_7.x86_64.rpm
MD5: cdf8f3a0686c07d6478dafa0a73be72b
SHA-256: 73d2af2d4af1a76e060a80c712732be117f78b06729df30af621869bac4ae206
Size: 2.48 MB - gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.i686.rpm
MD5: 999d7dad4eb0511a08996e1bc55d6237
SHA-256: 3ec332083d6686ea411257f84ee83f62f2046045839f7246151b321395cc6a15
Size: 313.87 kB - gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.x86_64.rpm
MD5: 1a33fa676ed45aa638ca703cb25e0461
SHA-256: e7f08381b59a5e516024f03fa68a138dc97188789ad205642d7d82dd34312241
Size: 313.96 kB - gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_7.i686.rpm
MD5: c955c88dddb90b29af91b9e46be5cceb
SHA-256: 0c81120057d71d6ad964b1b08d31649ec0329cd39839c5d89cb327a968dbe0cc
Size: 764.39 kB - gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_7.x86_64.rpm
MD5: 354fbf464b6edac2eb344370bab188fa
SHA-256: 14c365d1d835f09d7ff8ccd0ecd5c5ec5b4529a303246f615c72af86660be5ee
Size: 765.10 kB - gstreamer1-plugins-base-1.22.12-5.el9_7.i686.rpm
MD5: 5812bf5ae49ea4e5b4c726e168c1d0c4
SHA-256: 77e6e6f6f7a7f1eee1ea43bac1489105dcaf19863425229aac5434426ddc4f1f
Size: 2.29 MB - gstreamer1-plugins-base-1.22.12-5.el9_7.x86_64.rpm
MD5: 89f3e58808a16d6510c55a6a4c9ef7f6
SHA-256: d40b8c8e7f147b2f357b6d2455aac90a601cd89d7129dd64d5c554f6951f20c0
Size: 2.23 MB - gstreamer1-plugins-base-devel-1.22.12-5.el9_7.i686.rpm
MD5: a75acff0bbc42c0bf47105ca9ad8f123
SHA-256: fc90393b6cbb8602a3c2846dcc35f74c2467df7a8692adbadac33015bee39e36
Size: 522.29 kB - gstreamer1-plugins-base-devel-1.22.12-5.el9_7.x86_64.rpm
MD5: 02ed88d798938432a136b6f655eee041
SHA-256: a3d0b9fb3c3cf53058420a2a4c9b23933956f04d03c847cae642e3d2e812bcc1
Size: 522.64 kB - gstreamer1-plugins-base-tools-1.22.12-5.el9_7.x86_64.rpm
MD5: 3ae35960dfd1bb27feb51843722cdbf9
SHA-256: ecbd0a440d2713fb662ff2b1c1eb75da3cdb774a6d623c7842da86ca2315c51c
Size: 44.54 kB - gstreamer1-plugins-good-1.22.12-5.el9_7.i686.rpm
MD5: 1144781b9b7b50bf2fed3477e37ff9b0
SHA-256: 5ab914e4b4367f77a7e52d111a6fbdec7644a48baaac130f2cf60874313d8794
Size: 2.49 MB - gstreamer1-plugins-good-1.22.12-5.el9_7.x86_64.rpm
MD5: 83112e2eb48714cde391ea679375b5fe
SHA-256: 24449f246584d25910de5cc574f650d52bc48fdfb2fa90d5ca670d7f831e08ce
Size: 2.40 MB - gstreamer1-plugins-good-gtk-1.22.12-5.el9_7.i686.rpm
MD5: 446430970deb7565ee5de432166732c0
SHA-256: c24e2fe07c4bf0dc6c0fa7fdd46672564f728dc745827cd567ec24c7b45bb501
Size: 33.83 kB - gstreamer1-plugins-good-gtk-1.22.12-5.el9_7.x86_64.rpm
MD5: 048f5df9e600858b3eea9a8700940cff
SHA-256: 9c5b23019b4167023b44da191323bf045a492b66e9bea69910eb0a6a2315d5fc
Size: 32.50 kB - gstreamer1-plugins-ugly-free-1.22.12-4.el9_7.i686.rpm
MD5: d84c8e4e67b37cec17ffbd418982ec70
SHA-256: ed7643d263b3a36ff86adf8acdf76a16a4abc37c45164604ed846953da31848a
Size: 287.94 kB - gstreamer1-plugins-ugly-free-1.22.12-4.el9_7.x86_64.rpm
MD5: b7387e107e2550ee19ec3fec60b23744
SHA-256: c2322f8f1633867a689c5625d786a539934995205f9b24fc534410e224bbc5ab
Size: 278.57 kB
English