[Git][security-tracker-team/security-tracker][master] Reserve DLA-4837-1 for gst-plugins-good1.0
Andreas Henriksson (@ah)
gitlab at salsa.debian.org
Thu Oct 15 16:51:35 BST 2026
Andreas Henriksson pushed to branch master at Debian Security Tracker / security-tracker
Commits:
addeeeb6 by Andreas Henriksson at 2026-10-15T17:51:26+02:00
Reserve DLA-4837-1 for gst-plugins-good1.0
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -202929,14 +202929,12 @@ CVE-2026-3086 (GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Exec
CVE-2026-3083 (GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulne ...)
{DSA-6359-1}
- gst-plugins-good1.0 1.28.1-1
- [bookworm] - gst-plugins-good1.0 <no-dsa> (Minor issue)
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, obsolete codec, dropped upstream as a fix)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0008.html
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8349cdd35f85246e113b18e55fd11abf9cb248bf (main)
CVE-2026-3085 (GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Executio ...)
{DSA-6359-1}
- gst-plugins-good1.0 1.28.1-1
- [bookworm] - gst-plugins-good1.0 <no-dsa> (Minor issue)
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, obsolete codec, dropped upstream as a fix)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0008.html
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8349cdd35f85246e113b18e55fd11abf9cb248bf (main)
@@ -202984,7 +202982,6 @@ CVE-2026-2921 (GStreamer RIFF Palette Integer Overflow Remote Code Execution Vul
CVE-2026-1940 (An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in g ...)
{DSA-6359-1}
- gst-plugins-good1.0 1.28.1-1
- [bookworm] - gst-plugins-good1.0 <no-dsa> (Minor issue)
[bullseye] - gst-plugins-good1.0 <postponed> (Minor issue, OOB read)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0001.html
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ce2e822775bc5d192009617827bb6e9f0f98ca22 (main)
@@ -285475,7 +285472,6 @@ CVE-2025-47188 (A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w
CVE-2025-47183 (In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree fu ...)
{DLA-4419-1}
- gst-plugins-good1.0 1.26.2-1
- [bookworm] - gst-plugins-good1.0 <no-dsa> (Minor issue)
NOTE: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
NOTE: https://gstreamer.freedesktop.org/security/sa-2025-0005.html
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/48bf6a92d75051be7e5ffb66fcd1a49de74fe865 (1.27.1)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[15 Oct 2026] DLA-4837-1 gst-plugins-good1.0 - security update
+ {CVE-2025-47183 CVE-2026-1940 CVE-2026-3083 CVE-2026-3085 CVE-2026-17072 CVE-2026-18298 CVE-2026-18299 CVE-2026-39043 CVE-2026-39044 CVE-2026-53705 CVE-2026-73433 CVE-2026-73434 CVE-2026-85150 CVE-2026-88914}
+ [bookworm] - gst-plugins-good1.0 1.22.0-5+deb12u4
[15 Oct 2026] DLA-4836-1 firefox-esr - security update
{CVE-2026-109705 CVE-2026-109706 CVE-2026-109707 CVE-2026-109708 CVE-2026-109709 CVE-2026-109710 CVE-2026-109711 CVE-2026-109712 CVE-2026-109713 CVE-2026-109715 CVE-2026-109716 CVE-2026-109717 CVE-2026-109718 CVE-2026-109719 CVE-2026-109720 CVE-2026-109721 CVE-2026-109722 CVE-2026-109723 CVE-2026-109724 CVE-2026-109725 CVE-2026-109726 CVE-2026-109727 CVE-2026-109728 CVE-2026-109729 CVE-2026-109730 CVE-2026-109731 CVE-2026-109732 CVE-2026-109733 CVE-2026-109734 CVE-2026-109736 CVE-2026-109737 CVE-2026-109738 CVE-2026-109741 CVE-2026-109742 CVE-2026-109743 CVE-2026-109744 CVE-2026-109745 CVE-2026-109751 CVE-2026-109752 CVE-2026-109753 CVE-2026-109754 CVE-2026-109756 CVE-2026-109757 CVE-2026-109759 CVE-2026-109760 CVE-2026-109762 CVE-2026-109763 CVE-2026-109764 CVE-2026-109765 CVE-2026-109766 CVE-2026-109767 CVE-2026-109770 CVE-2026-109775 CVE-2026-109776 CVE-2026-109777 CVE-2026-109778 CVE-2026-109781 CVE-2026-109782 CVE-2026-109783}
[bookworm] - firefox-esr 153.5.0esr-1~deb12u1
=====================================
data/dla-needed.txt
=====================================
@@ -270,10 +270,6 @@ graphicsmagick
gst-plugins-bad1.0
NOTE: 20260612: Added by Front-Desk (rouca)
--
-gst-plugins-good1.0 (ah)
- NOTE: 20260520: Added by Front-Desk (Beuc)
- NOTE: 20260520: 6 CVEs piled up since December (Beuc)
---
gvfs
NOTE: 20260919: Added by Front-Desk (Beuc)
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/addeeeb63ff7b333100673d10a3c110c7e7ae984
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/addeeeb63ff7b333100673d10a3c110c7e7ae984
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/b640062a/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list