UbuntuUpdates.org

Package "gstreamer1.0-plugins-good"

Name: gstreamer1.0-plugins-good

Description:

GStreamer plugins from the "good" set
Latest version: 1.28.2-2ubuntu0.4
Release: resolute (26.04)
Level: security
Repository: main
Head package: gst-plugins-good1.0
Homepage: https://gstreamer.freedesktop.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "gstreamer1.0-plugins-good"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "gstreamer1.0-plugins-good" in Resolute

Repository Area Version
base main 1.28.2-2
updates main 1.28.2-2ubuntu0.4

Changelog

Version: 1.28.2-2ubuntu0.4 2026-10-01 20:07:37 UTC

gst-plugins-good1.0 (1.28.2-2ubuntu0.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read in FLAC parsing
    - debian/patches/CVE-2026-17072.patch: Make sure enough data is
      available when parsing FLAC headers.
      in gst/matroska/matroska-ids.c
    - CVE-2026-17072
  * SECURITY UPDATE: Integer underflow in FUJIFILM metadata parsing
    - debian/patches/CVE-2026-73433.patch: Make sure enough data is available
      when parsing FUJIFILM strd in gst/avi/gstavidemux.c
    - debian/patches/CVE-2026-73433-post1.patch: Improve
      const-correctness in many places in gst/avi/gstavidemux.c
    - CVE-2026-73433
  * SECURITY UPDATE: Out-of-bounds read in gst_avi_demux_riff_parse_vprp
    - debian/patches/CVE-2026-73434.patch: Use correct divisor for
      calculating available number of vprp field infos in
      gst/avi/gstavidemux.c
    - CVE-2026-73434
  * SECURITY UPDATE: Integer overflow in isomp4 plugin
    - debian/patches/CVE-2026-88914-1.patch: Ensure enough data is available
      for reading closed caption boxes in gst/isomp4/qtdemux.c
    - debian/patches/CVE-2026-88914-2.patch: Don't try splitting CEA608
      samples without known framerate in gst/isomp4/qtdemux.c
    - CVE-2026-88914

 -- Kyle Kernick Tue, 29 Sep 2026 11:26:55 -0600
Source diff to previous version
CVE-2026-17072 A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedde
CVE-2026-73433 A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements
CVE-2026-73434 A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc
CVE-2026-88914 A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption

Version: 1.28.2-2ubuntu0.3 2026-09-21 20:07:34 UTC

gst-plugins-good1.0 (1.28.2-2ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Remote code execution in MRF file parsing
    - debian/patches/CVE-2026-1829X.patch: Validate box sizes in
      gst/isomp4/atomsrecovery.c
    - CVE-2026-18295
    - CVE-2026-18296
  * SECURITY UPDATE: Remote code execution in PNG parsing
    - debian/patches/CVE-2026-18298-1.patch: Drop rank to NONE in
      docs/gst_plugins_cache.json and ext/gdk_pixbuf/gstgdkpixbufdec.c
    - debian/patches/CVE-2026-18298-2.patch: Handle format and resolution
      changes correctly in ext/gdk_pixbuf/gstgdkpixbufdec.c
    - CVE-2026-18298
  * SECURITY UPDATE: Remote code execution in RTP processing
    - debian/patches/CVE-2026-18299-1.patch: Consider empty packets with the
      last flag as bad packets in gst/rtp/gstrtpsbcdepay.c
    - debian/patches/CVE-2026-18299-2.patch: Check that enough data is
      available for the payload header in gst/rtp/gstrtpsbcdepay.c
    - debian/patches/CVE-2026-18299-post1.patch: Remove wrong variable
      shadowing in gst/rtp/gstrtpsbcdepay.c
    - CVE-2026-18299

 -- Kyle Kernick Thu, 17 Sep 2026 11:23:16 -0600
Source diff to previous version
CVE-2026-1829 The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via th
CVE-2026-18295 GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c
CVE-2026-18296 GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi
CVE-2026-18298 GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi
CVE-2026-18299 GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff

Version: 1.28.2-2ubuntu0.2 2026-09-17 14:07:52 UTC

gst-plugins-good1.0 (1.28.2-2ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of Service via RTP Fragment Overflow
    - debian/patches/CVE-2026-18649-1.patch: rtph264depay: rtph265depay: Limit
      the maximum fragmentation unit size in docs/gst_plugins_cache.json,
      gst/rtp/gstrtph264depay.c, gst/rtp/gstrtph264depay.h,
      gst/rtp/gstrtph265depay.c, gst/rtp/gstrtph265depay.h.
    - debian/patches/CVE-2026-18649-2.patch: rtph264depay: rtph265depay: Reset
      missing fields when resetting during fragmentation unit handling in
      gst/rtp/gstrtph264depay.c, gst/rtp/gstrtph265depay.c.
    - CVE-2026-18649

 -- John Breton Wed, 16 Sep 2026 10:36:35 -0400
Source diff to previous version
CVE-2026-18649 A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size

Version: 1.28.2-2ubuntu0.1 2026-07-22 16:42:44 UTC
No changelog available yet.


About   -   Send Feedback to @ubuntu_updates