Most recent entries from all

ALSA-2026:36674 — Moderate: gstreamer1-plugins-ugly-free security update

Affected: AlmaLinux:9: gstreamer1-plugins-ugly-free

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-365380

fkie_cve-2026-53704

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.

GHSA-j3jj-fwr8-4v9m

RHSA-2026:36673 — Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

RHSA-2026:50688 — Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update

RLSA-2026:36674 — Moderate: gstreamer1-plugins-ugly-free security update

Affected: Rocky Linux:9: gstreamer1-plugins-ugly-free

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-53704

Affected: Ubuntu:16.04:LTS: gst-plugins-ugly1.0, Ubuntu:18.04:LTS: gst-plugins-ugly1.0, Ubuntu:20.04:LTS: gst-plugins-ugly1.0, Ubuntu:22.04:LTS: gst-plugins-ugly1.0, Ubuntu:24.04:LTS: gst-plugins-ugly1.0, Ubuntu:25.10: gst-plugins-ugly1.0, Ubuntu:26.04:LTS: gst-plugins-ugly1.0

WID-SEC-W-2026-1919 — GStreamer: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.