Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

openSUSE: 2024:0305-1 Important: gstreamer-plugins-bad Security Fix

opensuse
Calendar Grey September 17, 2024
Dist Opensuse Esm H88
This bulletin focuses on five vulnerabilities found in gstreamer-plugins-good and includes remediation steps tailored for Fedora.
An update that solves four vulnerabilities and has one errata is now available

Description

This update for gstreamer-plugins-bad fixes the following issues:

Adding references for already fixed vulnerability:

- CVE-2023-50186: Fixed heap-based buffer overflow in the AV1 codec parser

(ZDI-CAN-22300, bsc#1218534, bsc#1223263)

- CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow

(bsc#1215792).

- CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free

(bsc#1217213).

- CVE-2023-44429: Fixed GStreamer AV1 Codec Parsing Heap-based Buffer

Overflow (bsc#1217211).

Topics%20covered

Topics Covered

security advisory buffer overflow integer overflow important update openSUSE use-after-free gstreamer-plugins-bad

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.5:

zypper in -t patch openSUSE-2024-305=1

Package List

- openSUSE Leap 15.5 (aarch64 i586 ppc64le s390x x86_64):

gstreamer-plugins-bad-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-chromaprint-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-chromaprint-debuginfo-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-debuginfo-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-debugsource-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-devel-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-fluidsynth-1.22.0-lp155.3.10.1

gstreamer-plugins-bad-fluidsynth-debuginfo-1.22.0-lp155.3.10.1

gstreamer-transcoder-1.22.0-lp155.3.10.1

gstreamer-transcoder-debuginfo-1.22.0-lp155.3.10.1

gstreamer-transcoder-devel-1.22.0-lp155.3.10.1

libgstadaptivedemux-1_0-0-1.22.0-lp155.3.10.1

libgstadaptivedemux-1_0-0-debuginfo-1.22.0-lp155.3.10.1

libgstbadaudio-1_0-0-1.22.0-lp155.3.10.1

libgstbadaudio-1_0-0-debuginfo-1.22.0-lp155.3.10.1

libgstbasecamerabinsrc-1_0-0-1.22.0-lp155.3.10.1

libgstbasecamerabinsrc-1_0-0-debuginfo-1.22.0-lp155.3.10.1

libgstcodecparsers-1_0-0-1.22.0-lp155.3.10.1

libgstcodecparsers-1_0-0-debuginfo-1.22.0-lp1...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2023-40475.html

https://www.suse.com/security/cve/CVE-2023-44429.html

https://www.suse.com/security/cve/CVE-2023-44446.html

https://www.suse.com/security/cve/CVE-2023-50186.html

https://bugzilla.suse.com/1215792

https://bugzilla.suse.com/1217211

https://bugzilla.suse.com/1217213

https://bugzilla.suse.com/1218534

https://bugzilla.suse.com/1223263

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2024:0305-1
Rating: important
Affected Products: openSUSE Leap 15.5 ble.

Topics%20covered

Topics Covered

security advisory buffer overflow integer overflow important update openSUSE use-after-free gstreamer-plugins-bad

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here