Updated gstreamer1.0 packages fix security vulnerabilities
Publication date: 15 Apr 2021Modification date: 15 Apr 2021
Type: security
Affected Mageia releases : 7 , 8
Description
GStreamer before 1.18.4 might access already-freed memory in error code
paths when demuxing certain malformed Matroska files (SA-2021-0002).
GStreamer before 1.18.4 might cause heap corruption when parsing certain
malformed Matroska files (SA-2021-0003).
GStreamer before 1.18.4 might do an out-of-bounds read when handling
certain RealMedia files or streams (SA-2021-0004).
GStreamer before 1.18.4 might cause stack corruptions with streams that
have more than 64 audio channels (SA-2021-0005).
It might be possible for a malicious third party to trigger a crash in
the application, but possibly also an arbitrary code execution with the
privileges of the target user.
References
- https://bugs.mageia.org/show_bug.cgi?id=28685
- https://gstreamer.freedesktop.org/security/sa-2021-0002.html
- https://gstreamer.freedesktop.org/security/sa-2021-0003.html
- https://gstreamer.freedesktop.org/security/sa-2021-0004.html
- https://gstreamer.freedesktop.org/security/sa-2021-0005.html
- https://gstreamer.freedesktop.org/releases/1.18/#1.18.4
SRPMS
7/core
- gstreamer1.0-libav-1.16.0-1.1.mga7
- gstreamer1.0-plugins-good-1.16.0-1.1.mga7
- gstreamer1.0-plugins-ugly-1.16.0-1.1.mga7
7/tainted
- gstreamer1.0-plugins-ugly-1.16.0-1.1.mga7.tainted
8/core
- gstreamer1.0-libav-1.18.3-1.1.mga8
- gstreamer1.0-plugins-good-1.18.3-1.2.mga8
- gstreamer1.0-plugins-ugly-1.18.3-1.1.mga8
8/tainted
- gstreamer1.0-plugins-ugly-1.18.3-1.1.mga8.tainted