SUSE-SU-2024:3295-1

Опубликовано: 18 сент. 2024

Источник: suse-cvrf

Описание

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues:

Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

gstreamer-plugins-bad-1.20.1-150400.3.23.2

gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

libgstadaptivedemux-1_0-0-1.20.1-150400.3.23.2

libgstbadaudio-1_0-0-1.20.1-150400.3.23.2

libgstbasecamerabinsrc-1_0-0-1.20.1-150400.3.23.2

libgstcodecparsers-1_0-0-1.20.1-150400.3.23.2

libgstcodecs-1_0-0-1.20.1-150400.3.23.2

libgstinsertbin-1_0-0-1.20.1-150400.3.23.2

libgstisoff-1_0-0-1.20.1-150400.3.23.2

libgstmpegts-1_0-0-1.20.1-150400.3.23.2

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

libgstsctp-1_0-0-1.20.1-150400.3.23.2

libgsturidownloader-1_0-0-1.20.1-150400.3.23.2

libgstva-1_0-0-1.20.1-150400.3.23.2

libgstvulkan-1_0-0-1.20.1-150400.3.23.2

libgstwayland-1_0-0-1.20.1-150400.3.23.2

libgstwebrtc-1_0-0-1.20.1-150400.3.23.2

typelib-1_0-GstBadAudio-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstCodecs-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstInsertBin-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstMpegts-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlay-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlayer-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstWebRTC-1_0-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

gstreamer-plugins-bad-1.20.1-150400.3.23.2

gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

libgstadaptivedemux-1_0-0-1.20.1-150400.3.23.2

libgstbadaudio-1_0-0-1.20.1-150400.3.23.2

libgstbasecamerabinsrc-1_0-0-1.20.1-150400.3.23.2

libgstcodecparsers-1_0-0-1.20.1-150400.3.23.2

libgstcodecs-1_0-0-1.20.1-150400.3.23.2

libgstinsertbin-1_0-0-1.20.1-150400.3.23.2

libgstisoff-1_0-0-1.20.1-150400.3.23.2

libgstmpegts-1_0-0-1.20.1-150400.3.23.2

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

libgstsctp-1_0-0-1.20.1-150400.3.23.2

libgsturidownloader-1_0-0-1.20.1-150400.3.23.2

libgstva-1_0-0-1.20.1-150400.3.23.2

libgstvulkan-1_0-0-1.20.1-150400.3.23.2

libgstwayland-1_0-0-1.20.1-150400.3.23.2

libgstwebrtc-1_0-0-1.20.1-150400.3.23.2

typelib-1_0-GstBadAudio-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstCodecs-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstInsertBin-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstMpegts-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlay-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlayer-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstWebRTC-1_0-1.20.1-150400.3.23.2

SUSE Linux Enterprise Server 15 SP4-LTSS

gstreamer-plugins-bad-1.20.1-150400.3.23.2

gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

libgstadaptivedemux-1_0-0-1.20.1-150400.3.23.2

libgstbadaudio-1_0-0-1.20.1-150400.3.23.2

libgstbasecamerabinsrc-1_0-0-1.20.1-150400.3.23.2

libgstcodecparsers-1_0-0-1.20.1-150400.3.23.2

libgstcodecs-1_0-0-1.20.1-150400.3.23.2

libgstinsertbin-1_0-0-1.20.1-150400.3.23.2

libgstisoff-1_0-0-1.20.1-150400.3.23.2

libgstmpegts-1_0-0-1.20.1-150400.3.23.2

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

libgstsctp-1_0-0-1.20.1-150400.3.23.2

libgsturidownloader-1_0-0-1.20.1-150400.3.23.2

libgstva-1_0-0-1.20.1-150400.3.23.2

libgstvulkan-1_0-0-1.20.1-150400.3.23.2

libgstwayland-1_0-0-1.20.1-150400.3.23.2

libgstwebrtc-1_0-0-1.20.1-150400.3.23.2

typelib-1_0-GstBadAudio-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstCodecs-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstInsertBin-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstMpegts-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlay-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlayer-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstWebRTC-1_0-1.20.1-150400.3.23.2

SUSE Linux Enterprise Server for SAP Applications 15 SP4

gstreamer-plugins-bad-1.20.1-150400.3.23.2

gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

libgstadaptivedemux-1_0-0-1.20.1-150400.3.23.2

libgstbadaudio-1_0-0-1.20.1-150400.3.23.2

libgstbasecamerabinsrc-1_0-0-1.20.1-150400.3.23.2

libgstcodecparsers-1_0-0-1.20.1-150400.3.23.2

libgstcodecs-1_0-0-1.20.1-150400.3.23.2

libgstinsertbin-1_0-0-1.20.1-150400.3.23.2

libgstisoff-1_0-0-1.20.1-150400.3.23.2

libgstmpegts-1_0-0-1.20.1-150400.3.23.2

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

libgstsctp-1_0-0-1.20.1-150400.3.23.2

libgsturidownloader-1_0-0-1.20.1-150400.3.23.2

libgstva-1_0-0-1.20.1-150400.3.23.2

libgstvulkan-1_0-0-1.20.1-150400.3.23.2

libgstwayland-1_0-0-1.20.1-150400.3.23.2

libgstwebrtc-1_0-0-1.20.1-150400.3.23.2

typelib-1_0-GstBadAudio-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstCodecs-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstInsertBin-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstMpegts-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlay-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstPlayer-1_0-1.20.1-150400.3.23.2

typelib-1_0-GstWebRTC-1_0-1.20.1-150400.3.23.2

SUSE Manager Proxy 4.3

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

SUSE Manager Server 4.3

libgstphotography-1_0-0-1.20.1-150400.3.23.2

libgstplay-1_0-0-1.20.1-150400.3.23.2

libgstplayer-1_0-0-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/support/update/announcement/2024/suse-su-20243295-1/
Link for SUSE-SU-2024:3295-1
https://lists.suse.com/pipermail/sle-updates/2024-September/036933.html
E-Mail link for SUSE-SU-2024:3295-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1218534
SUSE Bug 1218534
https://bugzilla.suse.com/1219494
SUSE Bug 1219494
https://bugzilla.suse.com/1223263
SUSE Bug 1223263
https://bugzilla.suse.com/1226892
SUSE Bug 1226892
https://bugzilla.suse.com/1226897
SUSE Bug 1226897
https://bugzilla.suse.com/1226898
SUSE Bug 1226898
https://bugzilla.suse.com/1226899
SUSE Bug 1226899
https://bugzilla.suse.com/1226900
SUSE Bug 1226900
https://bugzilla.suse.com/1226901
SUSE Bug 1226901
https://www.suse.com/security/cve/CVE-2023-22656/
SUSE CVE CVE-2023-22656 page
https://www.suse.com/security/cve/CVE-2023-45221/
SUSE CVE CVE-2023-45221 page
https://www.suse.com/security/cve/CVE-2023-47169/
SUSE CVE CVE-2023-47169 page
https://www.suse.com/security/cve/CVE-2023-47282/
SUSE CVE CVE-2023-47282 page
https://www.suse.com/security/cve/CVE-2023-48368/
SUSE CVE CVE-2023-48368 page
https://www.suse.com/security/cve/CVE-2023-50186/
SUSE CVE CVE-2023-50186 page

Описание

Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-22656.html
CVE-2023-22656
https://bugzilla.suse.com/1226899
SUSE Bug 1226899

Описание

Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-45221.html
CVE-2023-45221
https://bugzilla.suse.com/1226898
SUSE Bug 1226898

Описание

Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-47169.html
CVE-2023-47169
https://bugzilla.suse.com/1226901
SUSE Bug 1226901

Описание

Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-47282.html
CVE-2023-47282
https://bugzilla.suse.com/1226900
SUSE Bug 1226900

Описание

Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-48368.html
CVE-2023-48368
https://bugzilla.suse.com/1226897
SUSE Bug 1226897

Описание

GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22300.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-chromaprint-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-devel-1.20.1-150400.3.23.2

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:gstreamer-plugins-bad-lang-1.20.1-150400.3.23.2

Ссылки

https://www.suse.com/security/cve/CVE-2023-50186.html
CVE-2023-50186
https://bugzilla.suse.com/1223263
SUSE Bug 1223263

SUSE-SU-2024:3295-1

Описание

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

SUSE Linux Enterprise Server 15 SP4-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP4

SUSE Manager Proxy 4.3

SUSE Manager Server 4.3

Ссылки

Уязвимость: CVE-2023-22656

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-45221

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-47169

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-47282

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-48368

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-50186

Описание

Затронутые продукты

Ссылки