gstreamer1-plugins-good-1.16.1-7.el8_10.3
エラータID: AXSA:2026-1676:05
リリース日:
2026/08/27 Thursday - 15:01
題名:
gstreamer1-plugins-good-1.16.1-7.el8_10.3
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- GStreamer gst-plugins-good には、リソースの制限を実施して
いない問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2026-18649)
- GStreamer gst-plugins-good (avidemux) には、整数アンダーフロー
の問題があるため、ローカルの攻撃者により、情報の漏洩、データ破壊、
およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-73433)
- GStreamer gst-plugins-good (avidemux) には、メモリ領域の範囲外
読み取りの問題があるため、ローカルの攻撃者により、情報の漏洩、
およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-73434)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-18649
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
CVE-2026-73433
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVE-2026-73434
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
追加情報:
N/A
ダウンロード:
SRPMS
- gstreamer1-plugins-good-1.16.1-7.el8_10.3.src.rpm
MD5: fafd6c0f966b398a9b1ca84462a6bba7
SHA-256: 1e4b11f14b7802145acaf2c61963391dd3d5cba5a943463ce8b79b6f20ae8233
Size: 3.76 MB
Asianux Server 8 for x86_64
- gstreamer1-plugins-good-1.16.1-7.el8_10.3.i686.rpm
MD5: 5453a7d7d833a88fed726da3a616ec72
SHA-256: aad289926c7d564fa9fa52ba815c01f35a036b776eb4975b778a3b3013329bf9
Size: 2.37 MB - gstreamer1-plugins-good-1.16.1-7.el8_10.3.x86_64.rpm
MD5: 175eaeaad4c6ff370b09985551abd553
SHA-256: c79672bfb9cda825d9ef4eeda73f058d823f3a36e3e1fa4c9fcfb4c3da3e0e3d
Size: 2.29 MB - gstreamer1-plugins-good-gtk-1.16.1-7.el8_10.3.i686.rpm
MD5: 20defd4ccad50fdb2f4233bc528fd0ad
SHA-256: a9e7048c14b36708a40a7ad102f0202a91393d6e1067e2de376c221043940c8a
Size: 38.41 kB - gstreamer1-plugins-good-gtk-1.16.1-7.el8_10.3.x86_64.rpm
MD5: de5306ec17c5b8539db396e1c05ab360
SHA-256: 7ba36d1a67427d3395dc27f989ca2ce4588a84f442992b5bb821001f234baf15
Size: 37.21 kB
English