{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports\n as Patch1001-Patch1005\n- drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies\n- CVE-2024-47615: carry the two halves of our backport the vendor omits. Its\n Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but\n leaves the function declared void, so the five `return -1` statements it\n writes are discarded and is_header_vorbis() still reports a malformed vorbis\n setup packet as a valid header; and it guards only against underrunning the\n ogg packet, where ours also stopped both advance loops from running past\n op->packet + op->bytes\n- CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's\n pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy\n n_channels entries - up to 255 from the Opus ID header - into the 64-entry\n dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64\n channels\n- 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference\n in the vendor's commit message; it is taken as a hardening change, with\n upstream 3d7a5666 on top so its overflow guard stops overflowing itself", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/advisories/2026/clsa-2026_1792258320.json" } ], "tracking": { "current_release_date": "2026-10-20T01:45:59Z", "generator": { "date": "2026-10-20T01:45:59Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792258320", "initial_release_date": "2026-10-17T17:32:02Z", "revision_history": [ { "date": "2026-10-17T17:32:02Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-20T01:45:59Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "gstreamer1-plugins-base: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-tools@1.10.4-2.0.3.el7.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.0.3.el7.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.0.3.el7.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-tools@1.10.4-2.0.3.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel@1.10.4-2.0.3.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product": { "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_id": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base@1.10.4-2.0.3.el7.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "product": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "product_id": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/gstreamer1-plugins-base-devel-docs@1.10.4-2.0.3.el7.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" }, "product_reference": "gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch" }, "product_reference": "gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-47607", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47607" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0024.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0024.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html", "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T17:32:02.412715Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-47615", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47615" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0026.html", "url": "https://gstreamer.freedesktop.org/security/sa-2024-0026.html" }, { "category": "external", "summary": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/", "url": "https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html", "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html" } ], "release_date": "2024-12-12T02:03:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-17T17:32:02.412715Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320", "product_ids": [ "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-devel-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64", "Red-Hat-7:gstreamer1-plugins-base-devel-docs-0:1.10.4-2.0.3.el7.tuxcare.els1.noarch", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.i686", "Red-Hat-7:gstreamer1-plugins-base-tools-0:1.10.4-2.0.3.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792258320" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }