- rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports as Patch1001-Patch1005 - drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies - CVE-2024-47615: carry the two halves of our backport the vendor omits. Its Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but leaves the function declared void, so the five `return -1` statements it writes are discarded and is_header_vorbis() still reports a malformed vorbis setup packet as a valid header; and it guards only against underrunning the ogg packet, where ours also stopped both advance loops from running past op->packet + op->bytes - CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy n_channels entries - up to 255 from the Opus ID header - into the 64-entry dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64 channels - 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference in the vendor's commit message; it is taken as a hardening change, with upstream 3d7a5666 on top so its overflow guard stops overflowing itself