gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1
エラータID: AXSA:2026-1442:02
リリース日:
2026/08/04 Tuesday - 16:18
題名:
gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- GStreamer の rfbsrc プラグインには、メモリ領域の範囲外書き込み
の問題があるため、リモートの攻撃者により、データ破壊、およびサービス
拒否攻撃を可能とする脆弱性が存在します。(CVE-2026-59691)
- GStreamer の DTLS プラグインには、スタックベースのバッファオーバー
フローの問題があるため、リモートの攻撃者により、サービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2026-59692)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-59691
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
CVE-2026-59692
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
追加情報:
N/A
ダウンロード:
SRPMS
- gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1.src.rpm
MD5: 9f482ee9c85f63907ca857600af73128
SHA-256: fd4584b97d0aa8498df6d6c526a9b426420b5e54e833ead720f2acd555592071
Size: 5.04 MB
Asianux Server 8 for x86_64
- gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1.i686.rpm
MD5: 1b185d8f1a7bf7bb6cfb1aeb9f407187
SHA-256: 20575ef244a268a906c9fe0bbea5756b4dd5747fd29189a52a79cefb7a6de410
Size: 1.91 MB - gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1.x86_64.rpm
MD5: 78419a9e5496c6e2dd8c5bacd22fe123
SHA-256: 2da390994792820be08a16037aa4231fc3ffdb342ba22ff4d25acc5cd30ea751
Size: 1.84 MB - gstreamer1-plugins-bad-free-devel-1.16.1-9.el8_10.1.i686.rpm
MD5: 36c370073c23fe0cd35c6602a3344f2b
SHA-256: 08844b161f71de3255c326162f6843f72c8bca6c13bbf48ebec4adc404de775f
Size: 526.23 kB - gstreamer1-plugins-bad-free-devel-1.16.1-9.el8_10.1.x86_64.rpm
MD5: ac5b86bb9cc876a892789c43e0513805
SHA-256: 3ff88cdc0099b4a0cc2413f8917069601cfbf97e07b81c9c3345a87e698003d5
Size: 526.28 kB
English