Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 519
Alerts This Week
Warning Icon 1 519

Red Hat Enterprise Linux 9 Security Update: RHSA-2023-2260-01 GStreamer

red hat
Calendar Grey May 9, 2023
Dist Redhat Esm H88
Oracle has revealed a critical patch for libxml2 in Solaris 11 to address multiple vulnerabilities.
An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer-plugins-good: Potential heap overwrite in gst_matroska_demux_add_wvpk_header() (CVE-2022-1920)
* gstreamer-plugins-good: Heap-based buffer overflow in the avi demuxer when handling certain AVI files (CVE-2022-1921)
* gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using zlib decompression (CVE-2022-1922)
* gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using bz2 decompression (CVE-2022-1923)
* gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using lzo decompression (CVE-2022-1924)
* gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using HEADERSTRIP decompression (CVE-2022-1925)
* gstreamer-plugins-good: Potential heap overwrite in mp4 demuxing using zlib decompression (CVE-2022-2122)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory moderate buffer overflow security fix Red Hat Enterprise Linux heap overflow gstreamer1-plugins-good

References

https://access.redhat.com/security/cve/CVE-2022-1920 https://access.redhat.com/security/cve/CVE-2022-1921 https://access.redhat.com/security/cve/CVE-2022-1922 https://access.redhat.com/security/cve/CVE-2022-1923 https://access.redhat.com/security/cve/CVE-2022-1924 https://access.redhat.com/security/cve/CVE-2022-1925 https://access.redhat.com/security/cve/CVE-2022-2122 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: gstreamer1-plugins-good-1.18.4-6.el9.src.rpm
aarch64: gstreamer1-plugins-good-1.18.4-6.el9.aarch64.rpm gstreamer1-plugins-good-debuginfo-1.18.4-6.el9.aarch64.rpm gstreamer1-plugins-good-debugsource-1.18.4-6.el9.aarch64.rpm gstreamer1-plugins-good-gtk-1.18.4-6.el9.aarch64.rpm gstreamer1-plugins-good-gtk-debuginfo-1.18.4-6.el9.aarch64.rpm gstreamer1-plugins-good-qt-debuginfo-1.18.4-6.el9.aarch64.rpm
ppc64le: gstreamer1-plugins-good-1.18.4-6.el9.ppc64le.rpm gstreamer1-plugins-good-debuginfo-1.18.4-6.el9.ppc64le.rpm gstreamer1-plugins-good-debugsource-1.18.4-6.el9.ppc64le.rpm gstreamer1-plugins-good-gtk-1.18.4-6.el9.ppc64le.rpm gstreamer1-plugins-good-gtk-debuginfo-1.18.4-6.el9.ppc64le.rpm gstreamer1-plugins-good-qt-debuginfo-1.18.4-6.el9.ppc64le.rpm
s390x: gstreamer1-plugins-good-1.18.4-6.el9.s390x.rpm gstreamer1-plugins-good-debuginfo-1.18.4-6.el9.s390x.rpm gstreamer1-plugins-good-debugsource-1.18.4-6.el9.s390x.rpm gstreamer1-plugins-good-gtk-1.18.4-6.el9.s390x.rpm gstreamer1-plugins-good-gtk-debuginfo-1.18.4-6.el9.s390x.rpm gstreamer1-plugins-good-qt-debuginfo-1.18.4-6.el9.s390x.rpm
x86_64: gstreamer1-plugins-good-1.18.4-6.el9.i686.rpm gstreamer1-plugins-good-1.18.4-6.el9.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2023:2260-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2260
Issue date: 2023-05-09

Topic

An update for gstreamer1-plugins-good is now available for Red HatEnterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate buffer overflow security fix Red Hat Enterprise Linux heap overflow gstreamer1-plugins-good

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2130935 - CVE-2022-1920 gstreamer-plugins-good: Potential heap overwrite in gst_matroska_demux_add_wvpk_header()

2130949 - CVE-2022-1921 gstreamer-plugins-good: Heap-based buffer overflow in the avi demuxer when handling certain AVI files

2130955 - CVE-2022-1922 gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using zlib decompression

2130959 - CVE-2022-1923 gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using bz2 decompression

2131003 - CVE-2022-1924 gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using lzo decompression

2131007 - CVE-2022-1925 gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using HEADERSTRIP decompression

2131018 - CVE-2022-2122 gstreamer-plugins-good: Potential heap overwrite in mp4 demuxing using zlib decompression

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.