Description
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 13 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 12 | gst-plugins-good1.0 | 1.10.1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu4ubuntu2.16.04.2 | — |
| Ubuntu 16.04 LTS | gst-plugins-good1.0 | 1.8.2-1ubuntu0.3 | — |
| Ubuntu 14.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu1ubuntu5.2 | — |
| Ubuntu 14.04 LTS | gst-plugins-good1.0 | 1.2.4-1~ubuntu1.3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | clutter-gst2 +1 | 2.0.18-1.el7 | RHSA-2017:2060 |
| RHEL 7 | gnome-video-effects | 0.4.3-1.el7 | RHSA-2017:2060 |
| RHEL 7 | gstreamer-plugins-bad-free +2 | 0.10.23-23.el7 | RHSA-2017:2060 |
| RHEL 7 | gstreamer-plugins-good +1 | 0.10.31-13.el7 | RHSA-2017:2060 |
| RHEL 7 | gstreamer1 +6 | 1.10.4-2.el7 | RHSA-2017:2060 |
| RHEL 7 | gstreamer1-plugins-base +3 | 1.10.4-1.el7 | RHSA-2017:2060 |
| RHEL 7 | orc +3 | 0.4.26-1.el7 | RHSA-2017:2060 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | gstreamer-0_10-plugins-good | 0.10.31-16.1 | SUSE-SU-2017:0210-1 |
| SLES 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES 12 SP1 | gstreamer-0_10-plugins-good | 0.10.31-13.3.3 | SUSE-SU-2017:0237-1 |
| SLES 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES for SAP 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES for SAP 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | clutter-gst2 +1 | 2.0.18-1.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | gnome-video-effects | 0.4.3-1.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | gstreamer-plugins-bad-free +2 | 0.10.23-23.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | gstreamer-plugins-good +1 | 0.10.31-13.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | gstreamer1 +6 | 1.10.4-2.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | gstreamer1-plugins-base +3 | 1.10.4-1.el7 | ELSA-2017-2060 |
| Oracle Linux 7 | orc +3 | 0.4.26-1.el7 | ELSA-2017-2060 |
Advisories 7
- RHSA-2017:2060 Red Hat Security Advisory: GStreamer security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2017:0225-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3288-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0237-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3303-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0210-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-2060 Moderate: GStreamer security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017
References
- 95163 vdb-entry
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- RHSA-2017:2060 vendor-advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=774897
- [oss-security] 20161204 Re: gstreamer multiple issues mailing-list
- GLSA-201705-10 vendor-advisory
- [oss-security] 20161201 gstreamer multiple issues mailing-list