Summary
Michael Randrianantenaina discovered that GStreamer's Ugly Plugins
incorrectly handled certain malformed RealMedia files. If a user were
tricked into opening a crafted media file, an attacker could possibly use
this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103,
CVE-2023-38104)
It was discovered that GStreamer's Ugly Plugins incorrectly handled certain
malformed ASF and RealMedia files. If a user were tricked into opening a
crafted media file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920,
CVE-2026-2922)
Tianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled
certain malformed RealMedia files. If a user were tricked into opening a
crafted media file, an attacker could possibly use this issue to cause a
denial of service or expose sensitive information. (CVE-2026-53703,
CVE-2026-53704)
Seonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled
certain malformed ASF files. If a user were tricked into opening a crafted
media file, an attacker could possibly use this issue to cause a denial of
service or expose sensitive information. (CVE-2026-19389)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-ugly1.0 | 1.8.3-1ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-ugly1.0 | 1.14.5-0ubuntu1~18.04.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-ugly1.0 | 1.16.2-2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | gst-plugins-ugly1.0 | 1.20.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | gst-plugins-ugly1.0 | 1.24.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | gst-plugins-ugly1.0 | 1.28.2-1ubuntu0.1~esm1 |
Vulnerabilities 7
-
High 8.8
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulne…
-
High 8.8
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulne…
-
High 7.8
GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulner…
-
High 7.8
GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability
GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnera…
-
High 7.1
Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values …
-
High 7.1
Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser
A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads f…
-
High 7.1
Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string…
References
-
report
https://ubuntu.com/security/CVE-2023-38103
-
report
https://ubuntu.com/security/CVE-2023-38104
-
report
https://ubuntu.com/security/CVE-2026-2920
-
report
https://ubuntu.com/security/CVE-2026-2922
-
report
https://ubuntu.com/security/CVE-2026-19389
-
report
https://ubuntu.com/security/CVE-2026-53703
-
report
https://ubuntu.com/security/CVE-2026-53704