Описание
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic (bsc#1268410).
- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:3299-1
- E-Mail link for SUSE-SU-2026:3299-1
- SUSE Security Ratings
- SUSE Bug 1268168
- SUSE Bug 1268406
- SUSE Bug 1268408
- SUSE Bug 1268410
- SUSE Bug 1268971
- SUSE Bug 1271168
- SUSE CVE CVE-2026-12892 page
- SUSE CVE CVE-2026-52720 page
- SUSE CVE CVE-2026-52721 page
- SUSE CVE CVE-2026-52722 page
- SUSE CVE CVE-2026-53702 page
- SUSE CVE CVE-2026-59692 page
Описание
A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.
Затронутые продукты
Ссылки
- CVE-2026-12892
- SUSE Bug 1268971
Описание
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.
Затронутые продукты
Ссылки
- CVE-2026-52720
- SUSE Bug 1268406
Описание
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-52721
- SUSE Bug 1268408
Описание
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-52722
- SUSE Bug 1268410
Описание
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
Затронутые продукты
Ссылки
- CVE-2026-53702
- SUSE Bug 1268168
Описание
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
Затронутые продукты
Ссылки
- CVE-2026-59692
- SUSE Bug 1271168