CLSA-2026-1790601978
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1790601978.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1790601978
- Upstream
- Published
- 2026-10-25T22:42:18Z
- Modified
- 2026-10-26T09:43:19Z
- Summary
- gstreamer1-plugins-base: Fix of CVE-2026-18297
- Details
-
- rebase onto Oracle 1.10.4-2.0.3.el7, which brings the vendor's own backports as Patch1001-Patch1005
- drop 3 of the 4 TuxCare CVE backports in favour of the vendor's copies
- CVE-2024-47615: carry the two halves of our backport the vendor omits. Its
Patch1003 adds the bounds guards to gst_parse_vorbis_setup_packet() but
leaves the function declared void, so the five
return -1statements it writes are discarded and is_header_vorbis() still reports a malformed vorbis setup packet as a valid header; and it guards only against underrunning the ogg packet, where ours also stopped both advance loops from running past op->packet + op->bytes - CVE-2024-47607: the vendor's Patch1001 bounds the write into the caller's pos[64] but not the two memcpys in gst_opus_dec_negotiate(), which copy n_channels entries - up to 255 from the Opus ID header - into the 64-entry dec->opus_pos; take upstream 178ae5ac, which drops the positions above 64 channels
- 1004-video-info-Sanity-check-the-frame-size-to.patch carries no CVE reference in the vendor's commit message; it is taken as a hardening change, with upstream 3d7a5666 on top so its overflow guard stops overflowing itself
- References