Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1940: An out-of-bounds read in the WAV parser that can cause crashes for certain input files.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gstreamer1-plugins-good | 0:1.24.10-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gstreamer1-plugins-good-debuginfo | 0:1.24.10-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gstreamer1-plugins-good-debugsource | 0:1.24.10-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gstreamer1-plugins-good-gtk | 0:1.24.10-1.amzn2023.0.5 |
| Amazon Linux · 2023 | gstreamer1-plugins-good-gtk-debuginfo | 0:1.24.10-1.amzn2023.0.5 |
Vulnerabilities 1
-
Medium 5.1
Gstreamer: incomplete fix of cve-2026-1940
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. Whe…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-1940.html