gstreamer1-plugins-bad-free-1.22.12-7.el9_8.3
エラータID: AXSA:2026-1642:04
リリース日:
2026/08/25 Tuesday - 10:42
題名:
gstreamer1-plugins-bad-free-1.22.12-7.el9_8.3
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- GStreamer の rfbsrc プラグインには、メモリ領域の範囲外
書き込みの問題があるため、リモートの攻撃者により、データ破壊、
およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-59691)
- GStreamer の DTLS プラグインには、スタックベースのバッファ
オーバーフローの問題があるため、リモートの攻撃者により、サービス
拒否攻撃を可能とする脆弱性が存在します。(CVE-2026-59692)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-59691
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
CVE-2026-59692
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
追加情報:
N/A
ダウンロード:
SRPMS
- gstreamer1-plugins-bad-free-1.22.12-7.el9_8.3.src.rpm
MD5: 03471e84710a948cf19212af8c0a3350
SHA-256: 4a04a15892c93cfd5bad851f5342b15cd27357c2ac6cddf4f6cec1f3599889f2
Size: 5.34 MB
Asianux Server 9 for x86_64
- gstreamer1-plugins-bad-free-1.22.12-7.el9_8.3.i686.rpm
MD5: ff575e8e6d337b3328293f04ef30fb6b
SHA-256: e305b7700a411200895a226d6070ffdfbc8bdcab41035d5a4685dfd0287d52eb
Size: 2.56 MB - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.3.x86_64.rpm
MD5: 43e3b83311a31493f37d877b6b1631b4
SHA-256: 74233c516b1514c90ebb37c6e42f0bc2f3388ffb0dff55c685b9e49385c91ae6
Size: 2.48 MB - gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.i686.rpm
MD5: dd67cd3cf3b0f7db1b4c40088bc72a13
SHA-256: db0201a73678e862590c1e080089eca4bd9627d47dd720851622e01d80b9b316
Size: 314.88 kB - gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.x86_64.rpm
MD5: 67866d4f7641b79e254c98ec554f690b
SHA-256: 9d8bc458603a93fed9d12ed1799d4077849560f23dfccaaca94b64baf1383069
Size: 314.95 kB - gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.3.i686.rpm
MD5: 091f80d97a567ef3d50b8eeec44edaac
SHA-256: 112777d8c0ddc323bc3e591b3499a1671b59bb56fa6b0b2da220c791d42214c8
Size: 765.69 kB - gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.3.x86_64.rpm
MD5: f20895c1bacd08bf8116b11192eb7d1a
SHA-256: ad5a8337c1689414f28716d2a2db188d5022453693e814a0d646ce9971d7559e
Size: 766.05 kB
English