Summary
[1.10.4-4.0.5]
- Security update for CVE-2026-59691 CVE-2026-59692 [Orabug: 39878399]
[1.10.4-4.0.3]
- Security update for CVE-2026-52720 CVE-2026-52722 [Orabug: 39799399]
[1.10.4-4.0.1]
- Security update for CVE-2026-3082 [Orabug: 39199326]
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | gstreamer1-plugins-bad-free | 0:1.10.4-4.0.5.el7_9 |
| Oracle Linux · 7 | gstreamer1-plugins-bad-free-devel | 0:1.10.4-4.0.5.el7_9 |
| Oracle Linux · 7 | gstreamer1-plugins-bad-free-gtk | 0:1.10.4-4.0.5.el7_9 |
Vulnerabilities 2
-
High 7.5
Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker…
-
High 7.1
Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel value…