Skip to content
OpenAdvisories
Medium ALAS2-2025-2972 1 CVE

Moderate: gstreamer-plugins-bad-free security update (Amazon Linux 2)

Published Aug 12, 2025 · Updated Aug 19, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40474: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video NOTE: https://gstreamer.freedesktop.org/security/sa-2023-0006.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362 NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ce17e968e4cf900d28ca5b46f6e095febc42b4f0

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 gstreamer-plugins-bad-free 0:0.10.23-42.amzn2.0.3
Amazon Linux · 2 gstreamer-plugins-bad-free-debuginfo 0:0.10.23-42.amzn2.0.3
Amazon Linux · 2 gstreamer-plugins-bad-free-devel 0:0.10.23-42.amzn2.0.3
Amazon Linux · 2 gstreamer-plugins-bad-free-devel-docs 0:0.10.23-42.amzn2.0.3

Vulnerabilities 1

  • High 8.8
    CVE-2023-40474

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerabili…

    GStreamer GStreamer gst-plugins-bad1.0 gst-plugins-bad1.0 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-40474.html