Threat Intelligence Database

A security update addresses a vulnerability in gstreamer1-plugins-base affecting Red Hat Enterprise Linux 8 and related distributions. The issue is an arbitrary code execution vulnerability caused by a buffer overflow during OGG file parsing. The vulnerability is rated as high severity by the vendor. A patch is available from Red Hat as detailed in their advisory RHSA-2026:59487.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple remote code execution vulnerabilities have been identified in GStreamer plugins, including heap-based buffer overflows and integer overflow issues affecting JPEG parsing, RTP depayloading, and AVI file handling. These vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support and related packages. Red Hat has issued an important security advisory with updates to address these issues.

Multiple security vulnerabilities have been identified in GStreamer plugins included in Red Hat Enterprise Linux 10.0 Extended Update Support. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file parsers and demuxers such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. Red Hat has issued an important security advisory (RHSA-2026:8854) addressing these issues with updated packages. The vulnerabilities affect several GStreamer plugin packages: bad-free, base, good, and ugly-free. The advisory provides updated packages for multiple architectures and product variants. The severity is rated as high by the source. Patch availability is confirmed through the advisory with instructions for applying updates.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 9. These include out-of-bounds reads and writes, as well as NULL-pointer dereferences in various parsers such as ID3v2, SSA subtitle, format_channel_mask, and LRC subtitle parsers. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. Updates addressing these issues are available for Red Hat Enterprise Linux 9 and its extended update and lifecycle support versions.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8. These include stack-buffer overflows in vorbis_handle_identification_packet (CVE-2024-47538) and gst_opus_dec_parse_header (CVE-2024-47607), as well as an out-of-bounds write in the Ogg demuxer (CVE-2024-47615). These issues could potentially lead to memory corruption. Red Hat has released security updates addressing these vulnerabilities for various architectures and Extended Life Cycle versions of RHEL 8.

Multiple vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8.8 Extended Update Support. These include stack-buffer overflows in vorbis_handle_identification_packet (CVE-2024-47538) and gst_opus_dec_parse_header (CVE-2024-47607), as well as an out-of-bounds write in the Ogg demuxer (CVE-2024-47615). These issues could potentially lead to memory corruption. Red Hat has released security updates addressing these vulnerabilities.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8.6. These include stack-buffer overflows in vorbis_handle_identification_packet (CVE-2024-47538) and gst_opus_dec_parse_header (CVE-2024-47607), as well as an out-of-bounds write in the Ogg demuxer (CVE-2024-47615). Red Hat has issued a security advisory (RHSA-2024:11141) addressing these issues with updated packages. The vulnerabilities are rated as important by Red Hat Product Security. Users of affected Red Hat Enterprise Linux 8.6 variants should apply the provided updates to remediate these issues.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8.4. These include stack-buffer overflows in vorbis_handle_identification_packet and gst_opus_dec_parse_header, as well as an out-of-bounds write in the Ogg demuxer. Red Hat has issued an important security advisory with updates to address these issues.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8.2. These include stack-buffer overflows and an out-of-bounds write affecting components that handle media data streams such as Vorbis and Opus audio codecs and the Ogg demuxer. The vulnerabilities are rated as important by Red Hat and have corresponding CVEs: CVE-2024-47538, CVE-2024-47607, and CVE-2024-47615. A security update addressing these issues has been released for Red Hat Enterprise Linux 8.2.