SUSE-SU-2024:0779-1: Security update for gstreamer-plugins-bad

Q: Which systems are most exposed to this issue?

Systems using the listed GStreamer Bad plugin components and processing MXF files are exposed, particularly where MXF content may come from an untrusted or remote source.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to cause processing of a crafted MXF file. The issue is a use-after-free vulnerability that can lead to remote code execution.

Q: How can I check whether my system may be affected?

Check whether the system has any of the listed SUSE GStreamer components installed, including libgstbadbase, libgstadaptivedemux, libgstmpegts, libgstbadaudio, libgstbadvideo, libgstcodecparsers, libgstgl, or libgsturidownloader, and whether the SUSE security update has been applied.

Published Mar 6, 2024

Updated

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

Affected Software

86 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/gstreamer-plugins-bad-devel<1.8.3-18.15.1

1.8.3-18.15.1

suse/gstreamer-plugins-bad-debuginfo<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debugsource<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstinsertbin<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstinsertbin<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)

Any of the following

suse/libgstadaptivedemux<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debugsource<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstgl<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstgl<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstadaptivedemux<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debuginfo<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstphotography<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstphotography<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)

suse/gstreamer-plugins-bad-lang<1.8.3-18.15.1

1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libgstadaptivedemux<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debugsource<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstgl<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstgl<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstadaptivedemux<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debuginfo<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstphotography<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstphotography<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 (noarch)

suse/gstreamer-plugins-bad-lang<1.8.3-18.15.1

1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)

Any of the following

suse/libgstadaptivedemux<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debugsource<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstgl<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstgl<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstadaptivedemux<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbadbase<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadaudio<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstcodecparsers<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbadvideo<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/gstreamer-plugins-bad-debuginfo<1.8.3-18.15.1

1.8.3-18.15.1

suse/libgstphotography<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgsturidownloader<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstmpegts<1_0-0-1.8.3-18.15.1

1_0-0-1.8.3-18.15.1

suse/libgstphotography<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

suse/libgstbasecamerabinsrc<1_0-0-debuginfo-1.8.3-18.15.1

1_0-0-debuginfo-1.8.3-18.15.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)

suse/gstreamer-plugins-bad-lang<1.8.3-18.15.1

1.8.3-18.15.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/gstreamer-plugins-bad-devel to a version that resolves this vulnerability.
Fixed in 1.8.3-18.15.1
Upgrade
Upgrade suse/gstreamer-plugins-bad-debuginfo to a version that resolves this vulnerability.
Fixed in 1.8.3-18.15.1
Upgrade
Upgrade suse/libgsturidownloader to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/gstreamer-plugins-bad-debugsource to a version that resolves this vulnerability.
Fixed in 1.8.3-18.15.1
Upgrade
Upgrade suse/libgsturidownloader to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstinsertbin to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstinsertbin to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstadaptivedemux to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstgl to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstgl to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstmpegts to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadbase to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/gstreamer-plugins-bad to a version that resolves this vulnerability.
Fixed in 1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadaudio to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstadaptivedemux to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstcodecparsers to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadbase to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadvideo to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadaudio to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstcodecparsers to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbadvideo to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstphotography to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbasecamerabinsrc to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstmpegts to a version that resolves this vulnerability.
Fixed in 1_0-0-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstphotography to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/libgstbasecamerabinsrc to a version that resolves this vulnerability.
Fixed in 1_0-0-debuginfo-1.8.3-18.15.1
Upgrade
Upgrade suse/gstreamer-plugins-bad-lang to a version that resolves this vulnerability.
Fixed in 1.8.3-18.15.1
Upgrade
Upgrade gstreamer-plugins-bad to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-779=1
Upgrade
Upgrade gstreamer-plugins-bad to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-779=1

Event History

Mar 6, 2024

Advisory Published

via SUSE·08:36 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-44446

Frequently Asked Questions

Which systems are most exposed to this issue?

Systems using the listed GStreamer Bad plugin components and processing MXF files are exposed, particularly where MXF content may come from an untrusted or remote source.

What does an attacker need to exploit the vulnerability?

An attacker needs to cause processing of a crafted MXF file. The issue is a use-after-free vulnerability that can lead to remote code execution.

How can I check whether my system may be affected?

Check whether the system has any of the listed SUSE GStreamer components installed, including libgstbadbase, libgstadaptivedemux, libgstmpegts, libgstbadaudio, libgstbadvideo, libgstcodecparsers, libgstgl, or libgsturidownloader, and whether the SUSE security update has been applied.

SUSE-SU-2024:0779-1: Security update for gstreamer-plugins-bad

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are most exposed to this issue?

What does an attacker need to exploit the vulnerability?

How can I check whether my system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed to this issue?

What does an attacker need to exploit the vulnerability?

How can I check whether my system may be affected?