MGASA-2021-0187 - Updated gstreamer1.0 packages fix security vulnerabilities

Publication date: 15 Apr 2021
URL: https://advisories.mageia.org/MGASA-2021-0187.html
Type: security
Affected Mageia releases: 7, 8

GStreamer before 1.18.4 might access already-freed memory in error code
paths when demuxing certain malformed Matroska files (SA-2021-0002).

GStreamer before 1.18.4 might cause heap corruption when parsing certain
malformed Matroska files (SA-2021-0003).

GStreamer before 1.18.4 might do an out-of-bounds read when handling
certain RealMedia files or streams (SA-2021-0004).

GStreamer before 1.18.4 might cause stack corruptions with streams that
have more than 64 audio channels (SA-2021-0005).

It might be possible for a malicious third party to trigger a crash in
the application, but possibly also an arbitrary code execution with the
privileges of the target user.

References:
- https://bugs.mageia.org/show_bug.cgi?id=28685
- https://gstreamer.freedesktop.org/security/sa-2021-0002.html
- https://gstreamer.freedesktop.org/security/sa-2021-0003.html
- https://gstreamer.freedesktop.org/security/sa-2021-0004.html
- https://gstreamer.freedesktop.org/security/sa-2021-0005.html
- https://gstreamer.freedesktop.org/releases/1.18/#1.18.4

SRPMS:
- 7/core/gstreamer1.0-libav-1.16.0-1.1.mga7
- 7/core/gstreamer1.0-plugins-good-1.16.0-1.1.mga7
- 7/core/gstreamer1.0-plugins-ugly-1.16.0-1.1.mga7
- 7/tainted/gstreamer1.0-plugins-ugly-1.16.0-1.1.mga7.tainted
- 8/tainted/gstreamer1.0-plugins-ugly-1.18.3-1.1.mga8.tainted
- 8/core/gstreamer1.0-libav-1.18.3-1.1.mga8
- 8/core/gstreamer1.0-plugins-good-1.18.3-1.2.mga8
- 8/core/gstreamer1.0-plugins-ugly-1.18.3-1.1.mga8