Описание
Уязвимость компонента RIFF мультимедийного фреймворка Gstreamer связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код
Вендор
Red Hat Inc.
Canonical Ltd.
Novell Inc.
Сообщество свободного программного обеспечения
ООО «Ред Софт»
Сообщество GStreamer
Наименование ПО
Red Hat Enterprise Linux
Ubuntu
Suse Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
OpenSUSE Leap
Suse Linux Enterprise Server
SUSE Enterprise Storage
SUSE Manager Proxy
SUSE Manager Server
Debian GNU/Linux
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Liberty Linux
SUSE Linux Micro
РЕД ОС
Gstreamer
Версия ПО
7 (Red Hat Enterprise Linux)
16.04 LTS (Ubuntu)
18.04 LTS (Ubuntu)
12 SP3 (Suse Linux Enterprise Desktop)
12 SP4 (Suse Linux Enterprise Desktop)
12 SP2 (SUSE Linux Enterprise Server for SAP Applications)
12 SP3 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
15.5 (OpenSUSE Leap)
12 SP3 (Suse Linux Enterprise Server)
12 SP4 (Suse Linux Enterprise Server)
8 (Red Hat Enterprise Linux)
12 SP2-BCL (Suse Linux Enterprise Server)
12 SP2-ESPOS (Suse Linux Enterprise Server)
15 (SUSE Linux Enterprise Server for SAP Applications)
15 SP1 (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-LTSS (Suse Linux Enterprise Server)
12 SP3-LTSS (Suse Linux Enterprise Server)
12 SP3-BCL (Suse Linux Enterprise Server)
6 (SUSE Enterprise Storage)
12 SP3-ESPOS (Suse Linux Enterprise Server)
12 SP2 (Suse Linux Enterprise Desktop)
12 SP2 (Suse Linux Enterprise Server)
15-LTSS (Suse Linux Enterprise Server)
20.04 LTS (Ubuntu)
12 SP4 LTSS (Suse Linux Enterprise Server)
12 SP4-ESPOS (Suse Linux Enterprise Server)
15 SP1-BCL (Suse Linux Enterprise Server)
15 SP1-LTSS (Suse Linux Enterprise Server)
4.0 (SUSE Manager Proxy)
4.0 (SUSE Manager Server)
15.3 (OpenSUSE Leap)
15 SP1 (Suse Linux Enterprise Server)
11 (Debian GNU/Linux)
12 (Debian GNU/Linux)
15.4 (OpenSUSE Leap)
15 SP3 (Suse Linux Enterprise Server)
15 SP3 (SUSE Linux Enterprise Server for SAP Applications)
4.2 (SUSE Manager Proxy)
4.2 (SUSE Manager Server)
15 SP3 (Suse Linux Enterprise Desktop)
7 (SUSE Enterprise Storage)
15 SP2 (Suse Linux Enterprise Server)
15 SP2 (SUSE Linux Enterprise Server for SAP Applications)
4.1 (SUSE Manager Server)
4.1 (SUSE Manager Proxy)
15 SP4 (Suse Linux Enterprise Server)
15 SP2 (Suse Linux Enterprise Desktop)
15 SP4 (Suse Linux Enterprise Desktop)
15 (Suse Linux Enterprise Server)
15 SP2-BCL (Suse Linux Enterprise Server)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
5.2 (SUSE Linux Enterprise Micro)
22.04 LTS (Ubuntu)
9 (Red Hat Enterprise Linux)
15 SP2-LTSS (Suse Linux Enterprise Server)
15 SP1 (Suse Linux Enterprise Desktop)
15 (Suse Linux Enterprise Desktop)
5.2 (openSUSE Leap Micro)
7.1 (SUSE Enterprise Storage)
5.3 (SUSE Linux Enterprise Micro)
5.3 (openSUSE Leap Micro)
8.2 Advanced Update Support (Red Hat Enterprise Linux)
15 SP3-LTSS (Suse Linux Enterprise Server)
15 SP3-BCL (Suse Linux Enterprise Server)
15 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP5 (Suse Linux Enterprise Server)
15 SP5 (Suse Linux Enterprise Desktop)
5.4 (SUSE Linux Enterprise Micro)
5.4 (openSUSE Leap Micro)
8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
5.5 (SUSE Linux Enterprise Micro)
5.5 (openSUSE Leap Micro)
9 (SUSE Liberty Linux)
8 (SUSE Liberty Linux)
15 SP4-LTSS (Suse Linux Enterprise Server)
15 SP6 (Suse Linux Enterprise Desktop)
15 SP6 (Suse Linux Enterprise Server)
24.04 LTS (Ubuntu)
9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux)
8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux)
8.6 Telecommunications Update Service (Red Hat Enterprise Linux)
8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
7 Extended Lifecycle Support (Red Hat Enterprise Linux)
9.4 Extended Update Support (Red Hat Enterprise Linux)
15 SP5-LTSS (Suse Linux Enterprise Server)
15 SP7 (Suse Linux Enterprise Desktop)
10 (Red Hat Enterprise Linux)
8.8 Telecommunications Update Service (Red Hat Enterprise Linux)
8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux)
9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
13 (Debian GNU/Linux)
6.0 (SUSE Linux Micro)
6.1 (SUSE Linux Micro)
8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux)
25.10 (Ubuntu)
9.6 Extended Update Support (Red Hat Enterprise Linux)
8.0 (РЕД ОС)
6.2 (SUSE Linux Micro)
10.0 Extended Update Support (Red Hat Enterprise Linux)
до 1.28.1 (Gstreamer)
10 (SUSE Liberty Linux)
Тип ПО
Операционная система
Прикладное ПО информационных систем
Операционные системы и аппаратные платформы
Red Hat Inc. Red Hat Enterprise Linux 7
Canonical Ltd. Ubuntu 16.04 LTS
Canonical Ltd. Ubuntu 18.04 LTS
Novell Inc. Suse Linux Enterprise Desktop 12 SP3
Novell Inc. Suse Linux Enterprise Desktop 12 SP4
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4
Novell Inc. OpenSUSE Leap 15.5
Novell Inc. Suse Linux Enterprise Server 12 SP3
Novell Inc. Suse Linux Enterprise Server 12 SP4
Red Hat Inc. Red Hat Enterprise Linux 8
Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP1
Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS
Novell Inc. Suse Linux Enterprise Desktop 12 SP2
Novell Inc. Suse Linux Enterprise Server 12 SP2
Novell Inc. Suse Linux Enterprise Server 15-LTSS
Canonical Ltd. Ubuntu 20.04 LTS
Novell Inc. Suse Linux Enterprise Server 12 SP4 LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS
Novell Inc. Suse Linux Enterprise Server 15 SP1-BCL
Novell Inc. Suse Linux Enterprise Server 15 SP1-LTSS
Novell Inc. OpenSUSE Leap 15.3
Novell Inc. Suse Linux Enterprise Server 15 SP1
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Сообщество свободного программного обеспечения Debian GNU/Linux 12
Novell Inc. OpenSUSE Leap 15.4
Novell Inc. Suse Linux Enterprise Server 15 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3
Novell Inc. Suse Linux Enterprise Desktop 15 SP3
Novell Inc. Suse Linux Enterprise Server 15 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2
Novell Inc. Suse Linux Enterprise Server 15 SP4
Novell Inc. Suse Linux Enterprise Desktop 15 SP2
Novell Inc. Suse Linux Enterprise Desktop 15 SP4
Novell Inc. Suse Linux Enterprise Server 15
Novell Inc. Suse Linux Enterprise Server 15 SP2-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4
Canonical Ltd. Ubuntu 22.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 9
Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS
Novell Inc. Suse Linux Enterprise Desktop 15 SP1
Novell Inc. Suse Linux Enterprise Desktop 15
Novell Inc. openSUSE Leap Micro 5.2
Novell Inc. openSUSE Leap Micro 5.3
Red Hat Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support
Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS
Novell Inc. Suse Linux Enterprise Server 15 SP3-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP5
Novell Inc. Suse Linux Enterprise Desktop 15 SP5
Novell Inc. openSUSE Leap Micro 5.4
Red Hat Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Novell Inc. openSUSE Leap Micro 5.5
Novell Inc. SUSE Liberty Linux 9
Novell Inc. SUSE Liberty Linux 8
Novell Inc. Suse Linux Enterprise Server 15 SP4-LTSS
Novell Inc. Suse Linux Enterprise Desktop 15 SP6
Novell Inc. Suse Linux Enterprise Server 15 SP6
Canonical Ltd. Ubuntu 24.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Red Hat Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Inc. Red Hat Enterprise Linux 9.4 Extended Update Support
Novell Inc. Suse Linux Enterprise Server 15 SP5-LTSS
Novell Inc. Suse Linux Enterprise Desktop 15 SP7
Red Hat Inc. Red Hat Enterprise Linux 10
Red Hat Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Сообщество свободного программного обеспечения Debian GNU/Linux 13
Novell Inc. SUSE Linux Micro 6.0
Novell Inc. SUSE Linux Micro 6.1
Red Hat Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Canonical Ltd. Ubuntu 25.10
Red Hat Inc. Red Hat Enterprise Linux 9.6 Extended Update Support
ООО «Ред Софт» РЕД ОС 8.0
Novell Inc. SUSE Linux Micro 6.2
Red Hat Inc. Red Hat Enterprise Linux 10.0 Extended Update Support
Novell Inc. SUSE Liberty Linux 10
Уровень опасности уязвимости
Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7.2)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7.8)
Средний уровень опасности (оценка CVSS 4.0 составляет 5.7)
Возможные меры по устранению уязвимости
В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Gstreamer:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e3a99c35266fc92dd6a18ac5fde028d0cda559e6
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2026-2921
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2026-2921.html
Для Ред ОС:
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2026-2921
Для Ubuntu:
https://ubuntu.com/security/CVE-2026-2921
Статус уязвимости
Подтверждена производителем
Наличие эксплойта
Данные уточняются
Информация об устранении
Уязвимость устранена
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
- ZDI
- ZDI-CAN
EPSS
Процентиль: 55%
0.00867
Низкий
7.8 High
CVSS3
7.2 High
CVSS2
Связанные уязвимости
CVSS3: 7.8
ubuntu
5 месяцев назад
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28854.
CVSS3: 7.8
redhat
5 месяцев назад
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28854.
CVSS3: 7.8
nvd
5 месяцев назад
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28854.
CVSS3: 7.8
debian
5 месяцев назад
GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerab ...
EPSS
Процентиль: 55%
0.00867
Низкий
7.8 High
CVSS3
7.2 High
CVSS2