SUSE-SU-2026:3299-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20263299-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3299-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:3299-1
- Upstream
CVE (6)
- CVE-2026-12892
- CVE-2026-52720
- CVE-2026-52721
- CVE-2026-52722
- CVE-2026-53702
- CVE-2026-59692
- Related
- Published
- 2026-07-27T16:58:29Z
- Modified
- 2026-07-28T10:00:10Z
- Summary
- Security update for gstreamer-plugins-bad
- Details
-
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic (bsc#1268410).
- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20263299-1/
- https://bugzilla.suse.com/1268168
- https://bugzilla.suse.com/1268406
- https://bugzilla.suse.com/1268408
- https://bugzilla.suse.com/1268410
- https://bugzilla.suse.com/1268971
- https://bugzilla.suse.com/1271168
- https://www.suse.com/security/cve/CVE-2026-12892
- https://www.suse.com/security/cve/CVE-2026-52720
- https://www.suse.com/security/cve/CVE-2026-52721
- https://www.suse.com/security/cve/CVE-2026-52722
- https://www.suse.com/security/cve/CVE-2026-53702
- https://www.suse.com/security/cve/CVE-2026-59692
Affected packages
SUSE:Linux Enterprise Server 12 SP5-LTSS / gstreamer-plugins-bad
Package
- Name
- gstreamer-plugins-bad
- Purl
- pkg:rpm/suse/gstreamer-plugins-bad&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.8.3-18.21.1
Ecosystem specific
{
"binaries": [
{
"gstreamer-plugins-bad": "1.8.3-18.21.1",
"gstreamer-plugins-bad-devel": "1.8.3-18.21.1",
"gstreamer-plugins-bad-lang": "1.8.3-18.21.1",
"libgstadaptivedemux-1_0-0": "1.8.3-18.21.1",
"libgstbadaudio-1_0-0": "1.8.3-18.21.1",
"libgstbadbase-1_0-0": "1.8.3-18.21.1",
"libgstbadvideo-1_0-0": "1.8.3-18.21.1",
"libgstbasecamerabinsrc-1_0-0": "1.8.3-18.21.1",
"libgstcodecparsers-1_0-0": "1.8.3-18.21.1",
"libgstgl-1_0-0": "1.8.3-18.21.1",
"libgstmpegts-1_0-0": "1.8.3-18.21.1",
"libgstphotography-1_0-0": "1.8.3-18.21.1",
"libgsturidownloader-1_0-0": "1.8.3-18.21.1"
}
]
}
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 / gstreamer-plugins-bad
Package
- Name
- gstreamer-plugins-bad
- Purl
- pkg:rpm/suse/gstreamer-plugins-bad&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.8.3-18.21.1
Ecosystem specific
{
"binaries": [
{
"gstreamer-plugins-bad": "1.8.3-18.21.1",
"gstreamer-plugins-bad-devel": "1.8.3-18.21.1",
"gstreamer-plugins-bad-lang": "1.8.3-18.21.1",
"libgstadaptivedemux-1_0-0": "1.8.3-18.21.1",
"libgstbadaudio-1_0-0": "1.8.3-18.21.1",
"libgstbadbase-1_0-0": "1.8.3-18.21.1",
"libgstbadvideo-1_0-0": "1.8.3-18.21.1",
"libgstbasecamerabinsrc-1_0-0": "1.8.3-18.21.1",
"libgstcodecparsers-1_0-0": "1.8.3-18.21.1",
"libgstgl-1_0-0": "1.8.3-18.21.1",
"libgstmpegts-1_0-0": "1.8.3-18.21.1",
"libgstphotography-1_0-0": "1.8.3-18.21.1",
"libgsturidownloader-1_0-0": "1.8.3-18.21.1"
}
]
}