Описание
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues
- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268168
- SUSE Bug 1268172
- SUSE Bug 1268406
- SUSE Bug 1268408
- SUSE Bug 1268410
- SUSE Bug 1268872
- SUSE Bug 1268971
- SUSE Bug 1271051
- SUSE Bug 1271168
- SUSE CVE CVE-2026-12891 page
- SUSE CVE CVE-2026-12892 page
- SUSE CVE CVE-2026-14935 page
- SUSE CVE CVE-2026-52720 page
- SUSE CVE CVE-2026-52721 page
- SUSE CVE CVE-2026-52722 page
- SUSE CVE CVE-2026-53701 page
- SUSE CVE CVE-2026-53702 page
- SUSE CVE CVE-2026-59692 page
Описание
A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.
Затронутые продукты
Ссылки
- CVE-2026-12891
- SUSE Bug 1268872
Описание
A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.
Затронутые продукты
Ссылки
- CVE-2026-12892
- SUSE Bug 1268971
Описание
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
Затронутые продукты
Ссылки
- CVE-2026-14935
- SUSE Bug 1271051
Описание
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.
Затронутые продукты
Ссылки
- CVE-2026-52720
- SUSE Bug 1268406
Описание
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-52721
- SUSE Bug 1268408
Описание
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-52722
- SUSE Bug 1268410
Описание
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-53701
- SUSE Bug 1268172
Описание
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
Затронутые продукты
Ссылки
- CVE-2026-53702
- SUSE Bug 1268168
Описание
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
Затронутые продукты
Ссылки
- CVE-2026-59692
- SUSE Bug 1271168