CLSA-2026-1792532987
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792532987.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792532987
- Upstream
- Published
- 2026-10-21T08:15:45Z
- Modified
- 2026-10-26T09:31:57Z
- Summary
- gstreamer1-plugins-good: Fix of 4 CVEs
- Details
-
- rebase onto Oracle 1.10.4-2.0.7.el7_9
- the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay: check that enough data is available in the adapter)
- keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize, which the vendor's backport leaves in 32-bit arithmetic on this branch
- keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port
- keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy
- renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle took 1008 and 1009 for its own patches in this build
- keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from 1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since Oracle took 1010 in this build
- References