Summary
[1.22.12-4]
- Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
- Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
- Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
- Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
- Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
- Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
- Resolves: RHEL-71189
[1.22.12-3]
- Rebuild
- Resolves: RHEL-38511, RHEL-41157
[1.22.12-2]
- Rebuild
- Resolves: RHEL-38511, RHEL-41157
[1.22.12-1]
- 1.22.12
[1.22.11-2]
- Qt6 re-rebuild
[1.22.11-1]
- 1.22.11
[1.22.9-1]
- Revert back to 1.22.9 (accidentally merged Rawhide to f40)
[1.24.0-2]
- Rebuild (qt6)
[1.24.0-1]
- Update to 1.24.0
[1.22.9-3]
- Rebuild (qt6)
[1.22.9-2]
- Rebuild for libvpx 1.14.x
[1.22.9-1]
- 1.22.9
[1.22.8-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
[1.22.8-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
[1.22.8-1]
- 1.22.8
[1.22.7-2]
- Rebuild (qt6)
[1.22.7-1]
- 1.22.7
[1.22.5-3]
- Rebuild (qt6)
[1.22.5-2]
- Rebuild (qt6)
[1.22.5-1]
- Update to 1.22.5
- Disable qt-egl and add some BuildRequires to make things compile.
[1.22.3-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
[1.22.3-2]
- Enable Qt6 plugin, disable Qt5 plugin for RHEL 10
[1.22.3-1]
- Update to 1.22.3
[1.22.2-1]
- Update to 1.22.2
[1.22.1-1]
- Update to 1.22.1
[1.22.0-2]
- rebuild for new libvpx
[1.22.0-1]
- Update to 1.22.0
[1.21.90-1]
- Update to 1.21.90
[1.20.5-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
[1.20.5-1]
- Update to 1.20.5
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | gstreamer1-plugins-good | 0:1.22.12-4.el9 |
| Oracle Linux · 9 | gstreamer1-plugins-good-gtk | 0:1.22.12-4.el9 |
Vulnerabilities 17
-
Medium 6.9
GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overfl…
-
Medium 6.9
GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_…
-
Medium 6.8
GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
-
Medium 6.8
GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_vid…
-
Medium 6.8
GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not proper…
-
Medium 6.8
GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the val…
-
Medium 6.8
GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_e…
-
Medium 5.1
GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked…
-
Medium 5.1
GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validatio…
-
Medium 5.1
GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of th…
-
Medium 5.1
GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked befo…
-
Medium 5.1
GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the in…
-
Medium 5.1
GHSL-2024-261: GStreamer has an OOB-read in parse_ds64
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before a…
-
Medium 5.1
GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value …
-
Medium 5.1
GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without c…
-
Medium 5.1
GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which c…
-
Medium 5.1
GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gs…