GStreamer Base Plugins could be made to crash or run programs as your login if it opened a specially crafted file.. ========================================================================== Ubuntu Security Notice USN-7175-1 December 18, 2024 gst-plugins-base1.0 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: GStreamer Base Plugins could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - gst-plugins-base1.0: GStreamer plugins Details: Antonio Morales discovered that GStreamer Base Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 gstreamer1.0-alsa 1.24.8-1ubuntu0.1 gstreamer1.0-gl 1.24.8-1ubuntu0.1 gstreamer1.0-plugins-base 1.24.8-1ubuntu0.1 gstreamer1.0-plugins-base-apps 1.24.8-1ubuntu0.1 gstreamer1.0-x 1.24.8-1ubuntu0.1 libgstreamer-gl1.0-0 1.24.8-1ubuntu0.1 libgstreamer-plugins-base1.0-0 1.24.8-1ubuntu0.1 Ubuntu 24.04 LTS gstreamer1.0-alsa 1.24.2-1ubuntu0.2 gstreamer1.0-gl 1.24.2-1ubuntu0.2 gstreamer1.0-plugins-base 1.24.2-1ubuntu0.2 gstreamer1.0-plugins-base-apps 1.24.2-1ubuntu0.2 gstreamer1.0-x 1.24.2-1ubuntu0.2 libgstreamer-gl1.0-0 1.24.2-1ubuntu0.2 libgstreamer-plugins-base1.0-0 1.24.2-1ubuntu0.2 Ubuntu 22.04 LTS gstreamer1.0-alsa 1.20.1-1ubuntu0.4 gstreamer1.0-gl 1.20.1-1ubuntu0.4 gstreamer1.0-plugins-base 1.20.1-1ubuntu0.4 gstreamer1.0-plugins-base-apps 1.20.1-1ubuntu0.4 gstreamer1.0-x 1.20.1-1ubuntu0.4 libgstreamer-gl1.0-0 1.20.1-1ubuntu0.4 libgstreamer-plugins-base1.0-0 1.20.1-1ubuntu0.4 Ubuntu 20.04 LTS gstreamer1.0-alsa 1.16.3-0ubuntu1.4 gstreamer1.0-gl 1.16.3-0ubuntu1.4 gstreamer1.0-plugins-base 1.16.3-0ubuntu1.4 gstreamer1.0-plugins-base-apps 1.16.3-0ubuntu1.4 gstreamer1.0-plugins-base-doc 1.16.3-0ubuntu1.4 gstreamer1.0-x 1.16.3-0ubuntu1.4 libgstreamer-gl1.0-0 1.16.3-0ubuntu1.4 libgstreamer-plugins-base1.0-0 1.16.3-0ubuntu1.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7175-1 CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835 Package Information: https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4 . A security vulnerability in GStreamer Base Plugins affects Ubuntu 18.04, 20.04, and 22.04 LTS. Users should update to enhance system security and prevent exploitation. GStreamer, Ubuntu Update, Base Plugins, Security Notice, Software Update. . Severity: Critical. LinuxSecurity.com Team
GStreamer Base Plugins could be made to crash or run programs as your login if it opened a specially crafted file.. ========================================================================== Ubuntu Security Notice USN-6798-1 May 29, 2024 gst-plugins-base1.0 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: GStreamer Base Plugins could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - gst-plugins-base1.0: GStreamer plugins Details: It was discovered that GStreamer Base Plugins incorrectly handled certain EXIF metadata. An attacker could possibly use this issue to execute arbitrary code or cause a crash. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS gstreamer1.0-plugins-base 1.24.2-1ubuntu0.1 Ubuntu 23.10 gstreamer1.0-plugins-base 1.22.6-1ubuntu0.1 Ubuntu 22.04 LTS gstreamer1.0-plugins-base 1.20.1-1ubuntu0.2 Ubuntu 20.04 LTS gstreamer1.0-plugins-base 1.16.3-0ubuntu1.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6798-1 CVE-2024-4453 Package Information: https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.1 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.22.6-1ubuntu0.1 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.2 https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.3 . GStreamer Base Plugins on Ubuntu may let attackers execute code or crash systems via crafted files. Update is advised.. GStreamer, Ubuntu, Plugin Crash Risk, Security Update, Program Execution. . LinuxSecurity.com Team
- Fixed WidevineCdm (DRM) plugin crashes ---- * New upstream version (92.0) ---- * New upstream version (91.0.2). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-056d3314d6 2021-09-24 20:04:10.618233 --------------------------------------------------------------------------------Name : firefox Product : Fedora 35 Version : 92.0 Release : 3.fc35 URL : https://www.firefox.com/en-US/?redirect_source=mozilla-org Summary : Mozilla Firefox Web browser Description : Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. --------------------------------------------------------------------------------Update Information: - Fixed WidevineCdm (DRM) plugin crashes ---- * New upstream version (92.0) ---- * New upstream version (91.0.2) --------------------------------------------------------------------------------ChangeLog: * Mon Sep 13 2021 Martin Stransky - 92.0-3 - Added fix for mozbz#1725828 * Thu Sep 9 2021 Martin Stransky - 92.0-2 - Disable test * Fri Sep 3 2021 Martin Stransky - 92.0-1 - Updated to 92.0 - Added fix for mozbz#1728749 - Added fix for mozbz#1708709 * Thu Aug 26 2021 Martin Stransky - 91.0.2-1 - Updated to 91.0.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #1993821 - SIGSEGV in plugin-container https://bugzilla.redhat.com/show_bug.cgi?id=1993821 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-056d3314d6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
- New upstream (44.0.2) - Fixed plugin crashes (rhbz#1259525) ---- - Updated to new upstream (44.0.1) - Fixed AppChooser dialog crashes. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-8794abe899 2016-02-16 23:30:31.082280 -------------------------------------------------------------------------------- Name : firefox Product : Fedora 22 Version : 44.0.2 Release : 3.fc22 URL : Summary : Mozilla Firefox Web browser Description : Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. -------------------------------------------------------------------------------- Update Information: - New upstream (44.0.2) - Fixed plugin crashes (rhbz#1259525) ---- - Updated to new upstream (44.0.1) - Fixed AppChooser dialog crashes -------------------------------------------------------------------------------- References: [ 1 ] Bug #1259525 - crash @ [nsSecretDecoderRing::decode()] https://bugzilla.redhat.com/show_bug.cgi?id=1259525 [ 2 ] Bug #1291190 - [GTK3] Crash at ApplicationChooser https://bugzilla.redhat.com/show_bug.cgi?id=1291190 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update firefox' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
- New upstream (44.0.2) - Fixed plugin crashes (rhbz#1259525). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-1d8f67dc76 2016-02-14 22:36:30.483704 -------------------------------------------------------------------------------- Name : firefox Product : Fedora 23 Version : 44.0.2 Release : 3.fc23 URL : Summary : Mozilla Firefox Web browser Description : Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. -------------------------------------------------------------------------------- Update Information: - New upstream (44.0.2) - Fixed plugin crashes (rhbz#1259525) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1259525 - crash @ [nsSecretDecoderRing::decode()] https://bugzilla.redhat.com/show_bug.cgi?id=1259525 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update firefox' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.