Multiple vulnerabilities have been discovered in GStreamer and GStreamer Plugins, the worst of which could lead to code execution.

Announced

2025-06-12

Revised

2025-06-12

Access

local and remote

Bugs

#948198

Advisory

https://security.gentoo.org/glsa/202506-02

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/gst-plugins-base	*	< 1.24.10	>= 1.24.10
media-libs/gstreamer	*	< 1.24.10	>= 1.24.10

Background

GStreamer is an open source multimedia framework.

Description

Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All GStreamer, GStreamer Plugins users should upgrade to the latest versions:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gstreamer-1.24.10" ">=media-libs/gst-plugins-bad-1.24.10"

References

• CVE-2024-44331
• CVE-2024-47537
• CVE-2024-47538
• CVE-2024-47539
• CVE-2024-47540
• CVE-2024-47541
• CVE-2024-47542
• CVE-2024-47543
• CVE-2024-47544
• CVE-2024-47545
• CVE-2024-47546
• CVE-2024-47596
• CVE-2024-47597
• CVE-2024-47598
• CVE-2024-47599
• CVE-2024-47600
• CVE-2024-47601
• CVE-2024-47602
• CVE-2024-47603
• CVE-2024-47606
• CVE-2024-47607
• CVE-2024-47613
• CVE-2024-47615
• CVE-2024-47774
• CVE-2024-47775
• CVE-2024-47776
• CVE-2024-47777
• CVE-2024-47778
• CVE-2024-47834
• CVE-2024-47835
• GStreamer-SA-2024-0003
• GStreamer-SA-2024-0004

Multiple vulnerabilities have been found in GStreamer and its plugins, the worst of which could result in arbitrary code execution.

Announced

2022-08-14

Revised

2022-08-14

Access

remote

Bugs

#766336 #785652 #785655 #785658 #785661 #835368 #843770 #765163

Advisory

https://security.gentoo.org/glsa/202208-31

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/gst-plugins-bad	*	< 1.16.3	>= 1.16.3
media-libs/gst-plugins-base	*	< 1.18.4	>= 1.18.4
media-libs/gst-plugins-good	*	< 1.18.4	>= 1.18.4
media-libs/gst-plugins-ugly	*	< 1.18.4	>= 1.18.4
media-libs/gstreamer	*	< 1.20.2	>= 1.20.2
media-plugins/gst-plugins-libav	*	< 1.18.4	>= 1.18.4

Background

GStreamer is an open source multimedia framework.

Description

Multiple vulnerabilities have been found in GStreamer and its plugins. Please review the CVE and GStreamer-SA identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All GStreamer users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gstreamer-1.20.2"

All gst-plugins-bad users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-bad-1.20.2"

All gst-plugins-good users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-good-1.20.2"

All gst-plugins-ugly users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-ugly-1.20.2"

All gst-plugins-base users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-base-1.20.2"

All gst-plugins-libav users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-plugins/gst-plugins-libav-1.20.2"

References

• CVE-2021-3185
• CVE-2021-3497
• CVE-2021-3498
• CVE-2021-3522
• GStreamer-SA-2021-0001
• GStreamer-SA-2021-0002
• GStreamer-SA-2021-0004
• GStreamer-SA-2021-0005

A heap-based buffer overflow in GStreamer Base Plugins might allow remote attackers to execute arbitrary code.

Announced

2020-03-15

Revised

2020-03-15

Access

remote

Bugs

#701294

Advisory

https://security.gentoo.org/glsa/202003-33

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/gst-plugins-base	*	< 1.14.5-r1	>= 1.14.5-r1

Background

A well-groomed and well-maintained collection of GStreamer plug-ins and elements, spanning the range of possible types of elements one would want to write for GStreamer.

Description

It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams.

Impact

A remote attacker could entice a user to open a specially crafted RTSP stream with a GStreamer application, possibly resulting in the execution of arbitrary code or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GStreamer Base Plugins users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-libs/gst-plugins-base-1.14.5-r1"

References

• CVE-2019-9928

Multiple vulnerabilities have been found in various GStreamer plug-ins, the worst of which could lead to the execution of arbitrary code.

Announced

2017-05-18

Revised

2017-05-18

Access

remote

Bugs

#600142 #601354

Advisory

https://security.gentoo.org/glsa/201705-10

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/gst-plugins-bad	*	< 1.10.3	>= 1.10.3
media-libs/gst-plugins-base	*	< 1.10.3	>= 1.10.3
media-libs/gst-plugins-good	*	< 1.10.3	>= 1.10.3
media-libs/gst-plugins-ugly	*	< 1.10.3	>= 1.10.3

Background

The GStreamer plug-ins provide decoders to the GStreamer open source media framework.

Description

Multiple vulnerabilities have been discovered in various GStreamer plug-ins. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user or automated system using a GStreamer plug-in to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All gst-plugins-bad users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-libs/gst-plugins-bad-1.10.3:1.0"

All gst-plugins-good users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-libs/gst-plugins-good-1.10.3:1.0"

All gst-plugins-base users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-libs/gst-plugins-base-1.10.3:1.0"

All gst-plugins-ugly users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=media-libs/gst-plugins-ugly-1.10.3:1.0"

References

• CVE-2016-10198
• CVE-2016-10199
• CVE-2016-9445
• CVE-2016-9446
• CVE-2016-9447
• CVE-2016-9634
• CVE-2016-9635
• CVE-2016-9636
• CVE-2016-9807
• CVE-2016-9808
• CVE-2016-9809
• CVE-2016-9810
• CVE-2016-9811
• CVE-2016-9812
• CVE-2016-9813
• CVE-2017-5837
• CVE-2017-5838
• CVE-2017-5839
• CVE-2017-5840
• CVE-2017-5841
• CVE-2017-5842
• CVE-2017-5843
• CVE-2017-5844
• CVE-2017-5845
• CVE-2017-5846
• CVE-2017-5847
• CVE-2017-5848

Multiple vulnerabilities in multiple GStreamer plug-ins might allow for the execution of arbitrary code.

Announced

2009-07-12

Revised

2009-07-12

Access

remote

Bugs

#256096 #261594 #272972

Advisory

https://security.gentoo.org/glsa/200907-11

Affected packages

Package	Arch	Vulnerable	Unaffected
media-libs/gst-plugins-base	*	< 0.10.22	>= 0.10.22
media-libs/gst-plugins-good	*	< 0.10.14	>= 0.10.14
media-plugins/gst-plugins-libpng	*	< 0.10.14-r1	>= 0.10.14-r1

Background

The GStreamer plug-ins provide decoders to the GStreamer open source media framework.

Description

Multiple vulnerabilities have been reported in several GStreamer plug-ins:

• Tobias Klein reported two heap-based buffer overflows and an array index error in the qtdemux_parse_samples() function in gst-plugins-good when processing a QuickTime media .mov file (CVE-2009-0386, CVE-2009-0387, CVE-2009-0397).
• Thomas Hoger of the Red Hat Security Response Team reported an integer overflow that can lead to a heap-based buffer overflow in the gst_vorbis_tag_add_coverart() function in gst-plugins-base when processing COVERART tags (CVE-2009-0586).
• Tielei Wang of ICST-ERCIS, Peking University reported multiple integer overflows leading to buffer overflows in gst-plugins-libpng when processing a PNG file (CVE-2009-1932).

Impact

A remote attacker could entice a user or automated system using a GStreamer plug-in to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All gst-plugins-good users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-good-0.10.14"

All gst-plugins-base users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/gst-plugins-base-0.10.22"

All gst-plugins-libpng users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-plugins/gst-plugins-libpng-0.10.14-r1"

References

• CVE-2009-0386
• CVE-2009-0387
• CVE-2009-0397
• CVE-2009-0586
• CVE-2009-1932