SUSE-SU-2023:3802-1: Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-37329: Fixed a heap overwrite in PGS subtitle overlay decoder (bsc#1213126).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libgstplayerto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-GstMpegts-1_0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstmpegtsto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-GstInsertBin-1_0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadallocatorsto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstwaylandto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstcodecparsersto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstinsertbinto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadbaseto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadbaseto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/gstreamer-plugins-badto a version that resolves this vulnerability.Fixed in 1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstwaylandto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadvideoto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstphotographyto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-GstBadAllocators-1_0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstcodecparsersto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadaudioto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstinsertbinto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-GstPlayer-1_0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbasecamerabinsrcto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstglto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgsturidownloaderto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstplayerto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgsturidownloaderto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstadaptivedemuxto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-GstGL-1_0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadaudioto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadvideoto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbasecamerabinsrcto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstbadallocatorsto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstmpegtsto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/gstreamer-plugins-bad-debugsourceto a version that resolves this vulnerability.Fixed in 1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstglto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/gstreamer-plugins-bad-develto a version that resolves this vulnerability.Fixed in 1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/gstreamer-plugins-bad-debuginfoto a version that resolves this vulnerability.Fixed in 1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstphotographyto a version that resolves this vulnerability.Fixed in 1_0-0-debuginfo-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/libgstadaptivedemuxto a version that resolves this vulnerability.Fixed in 1_0-0-1.12.5-150000.3.9.1 - Upgrade
Upgrade
suse/gstreamer-plugins-bad-langto a version that resolves this vulnerability.Fixed in 1.12.5-150000.3.9.1 - Upgrade
Upgrade
gstreamer-plugins-badto a version that resolves this vulnerability.Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3802=1 - Upgrade
Upgrade
gstreamer-plugins-badto a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3802=1 - Upgrade
Upgrade
gstreamer-plugins-badto a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3802=1
Event History
Frequently Asked Questions
What input would need to be processed to trigger this issue?
An attacker would need to cause the PGS subtitle overlay decoder to process crafted subtitle data. The update identifies the flaw as a heap overwrite in that decoder.
Which installed components are covered by this update?
The advisory lists suse/typelib, suse/libgstplayer, suse/libgstmpegts, suse/libgstbadallocators, suse/libgstwayland, suse/libgstcodecparsers, suse/libgstinsertbin, and suse/libgstbadbase.
How can I determine whether the SUSE security update applies to my environment?
Check whether your system has the listed SUSE gstreamer-plugins-bad-related components installed and whether it has received SUSE-SU-2023:3802-1, published on 2023-09-27.