Summary
[1.22.12-8.2]
- Fix CVE-2026-18297: opusdec channel position bounds check
Resolves: RHEL-246587
- Fix crash in RTSP auth credential parsing (CVE-2026-85150)
Resolves: RHEL-253753
[1.22.12-8.1]
- Sync with c9s release -5..-8: fix for CVE-2026-2921 in riff palette
parsing
Resolves: RHEL-156246
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | gstreamer1-plugins-base | 0:1.22.12-8.el9_8.2 |
| Oracle Linux · 9 | gstreamer1-plugins-base-devel | 0:1.22.12-8.el9_8.2 |
| Oracle Linux · 9 | gstreamer1-plugins-base-tools | 0:1.22.12-8.el9_8.2 |
Vulnerabilities 2
-
High 7.8
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability…
-
High 7.5
Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's term…