| Package | gst-plugins-base1.0 |
|---|---|
| Version | 1.14.4-2+deb10u7 (buster), 1.18.4-2+deb11u6 (bullseye) |
| Related CVEs | CVE-2026-18297 CVE-2026-85150 |
Multiple vulnerabilities were discovered in the GStreamer plugins base package, which could result in the execution of arbitrary code or denial of service.
CVE-2026-18297
A stack-based buffer overflow was discovered in the Ogg demuxer.
Insufficient validation of the length of user-supplied data while
parsing Ogg files could allow a remote attacker to execute
arbitrary code with the privileges of the application using
GStreamer, if a user opens a specially crafted media file or
visits a web page that loads one.
CVE-2026-85150
A NULL pointer dereference was discovered in the RTSP support
library when parsing an Authorization or WWW-Authenticate header
using Digest authentication. A remote, unauthenticated attacker
could crash an RTSP server with authentication enabled by sending
a single malformed request. A malicious RTSP server could likewise
crash a connecting RTSP client, resulting in denial of service.
For Debian 10 buster, these problems have been fixed in version 1.14.4-2+deb10u7.
For Debian 11 bullseye, these problems have been fixed in version 1.18.4-2+deb11u6.
We recommend that you upgrade your gst-plugins-base1.0 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.