[Git][security-tracker-team/security-tracker][master] Reserve DLA-4371-1 for gst-plugins-base1.0

[Jeremy Bícha (@jbicha)]

Jeremy Bícha pushed to branch master at Debian Security Tracker / security-tracker


Commits:
51ab3a9c by Jeremy Bicha at 2025-11-14T12:11:52-05:00
Reserve DLA-4371-1 for gst-plugins-base1.0

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -34807,7 +34807,6 @@ CVE-2025-47808 (In GStreamer through 1.26.1, the subparse plugin's tmplayer_pars
 CVE-2025-47807 (In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_for ...)
 	- gst-plugins-base1.0 1.26.2-1
 	[bookworm] - gst-plugins-base1.0 1.22.0-3+deb12u5
-	[bullseye] - gst-plugins-base1.0 <postponed> (Minor issue; can be fixed in next update)
 	NOTE: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
 	NOTE: https://gstreamer.freedesktop.org/security/sa-2025-0002.html
 	NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9132
@@ -34816,7 +34815,6 @@ CVE-2025-47807 (In GStreamer through 1.26.1, the subparse plugin's subrip_unesca
 CVE-2025-47806 (In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time f ...)
 	- gst-plugins-base1.0 1.26.2-1
 	[bookworm] - gst-plugins-base1.0 1.22.0-3+deb12u5
-	[bullseye] - gst-plugins-base1.0 <postponed> (Minor issue; can be fixed in next update)
 	NOTE: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
 	NOTE: https://gstreamer.freedesktop.org/security/sa-2025-0006.html
 	NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/edca7f83d107fb6a55dbd46196fc40b99857a85e (1.27.1)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[14 Nov 2025] DLA-4371-1 gst-plugins-base1.0 - security update
+	{CVE-2025-47806 CVE-2025-47807 CVE-2025-47808}
+	[bullseye] - gst-plugins-base1.0 1.18.4-2+deb11u4
 [13 Nov 2025] DLA-4370-1 firefox-esr - security update
 	{CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020}
 	[bullseye] - firefox-esr 140.5.0esr-1~deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -127,12 +127,6 @@ grub2
   NOTE: 20250522: https://lists.debian.org/debian-lts/2025/05/msg00056.html
   NOTE: 20250611: New maintainer ping from secteam (Beuc/front-desk)
 --
-gst-plugins-base1.0 (jbicha)
-  NOTE: 20251108: Added by Front-Desk (Beuc)
-  NOTE: 20251108: Low-priority, for new team members
-  NOTE: 20251108: Follow fixes from bookworm 12.12 (3 CVEs) (Beuc/front-desk)
-  NOTE: 20251113: Waiting for review https://salsa.debian.org/gstreamer-team/gst-plugins-base1.0/-/merge_requests/21
---
 gst-plugins-good1.0 (jbicha)
   NOTE: 20251108: Added by Front-Desk (Beuc)
   NOTE: 20251108: Low-priority, for new team members



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/51ab3a9c7e05bb2fad7038e5be68dbf8eb5c9a73

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/51ab3a9c7e05bb2fad7038e5be68dbf8eb5c9a73
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251114/c4f064bf/attachment-0001.htm>