RHSA-2024:2287: Moderate: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.Security Fix(es): gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video (CVE-2023-40474) gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (CVE-2023-40475) gstreamer-plugins-bad: Integer overflow in H.265 video parser leading to stack overwrite (CVE-2023-40476) gstreamer-plugins-bad-free: buffer overflow vulnerability (CVE-2023-50186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.
Other sources
Moderate: gstreamer1-plugins-bad-free security update
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:2287?
The severity of RHSA-2024:2287 is classified as critical due to an integer overflow leading to heap overwrite.
How do I fix RHSA-2024:2287?
You can fix RHSA-2024:2287 by updating to the fixed version 1.22.1-4.el9 of the gstreamer1-plugins-bad-free package.
What causes the vulnerability in RHSA-2024:2287?
The vulnerability in RHSA-2024:2287 is caused by an integer overflow in the gstreamer-plugins-bad component.
Which packages are affected by RHSA-2024:2287?
The affected packages for RHSA-2024:2287 include gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-debuginfo, and gstreamer1-plugins-bad-free-devel.
Is there a workaround for RHSA-2024:2287?
There are no known workarounds for RHSA-2024:2287; the best course of action is to apply the security update.