Summary
[1.10.4-4.0.3]
- Security update for CVE-2026-52720 CVE-2026-52722 [Orabug: 39799399]
[1.10.4-4.0.1]
- Security update for CVE-2026-3082 [Orabug: 39199326]
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | gstreamer1-plugins-bad-free | 0:1.10.4-4.0.3.el7_9 |
| Oracle Linux · 7 | gstreamer1-plugins-bad-free-devel | 0:1.10.4-4.0.3.el7_9 |
| Oracle Linux · 7 | gstreamer1-plugins-bad-free-gtk | 0:1.10.4-4.0.3.el7_9 |
Vulnerabilities 2
-
High 8.8
Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebu…
-
High 7.1
Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attack…