UBUNTU-CVE-2026-121629

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-121629

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-121629

Upstream

CVE-2026-121629

Published

2026-11-12T00:00:00Z

Modified

2026-11-12T23:46:20Z

Severity

Ubuntu - medium

Summary

[none]

Details

A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.

References

Affected packages

Ubuntu:22.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.18.5-1ubuntu2

1.18.5-1ubuntu3

1.20.0-2ubuntu1

1.20.1-1ubuntu1

1.20.3-0ubuntu1

1.20.3-0ubuntu1.1

1.20.3-0ubuntu1.3

1.20.3-0ubuntu1.4

1.20.3-0ubuntu1.5

1.20.3-0ubuntu1.6

1.20.3-0ubuntu1.7

1.20.3-0ubuntu1.8

1.20.3-0ubuntu1.9

1.20.3-0ubuntu1.10

1.20.3-0ubuntu1.11

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.20.3-0ubuntu1.11"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.20.3-0ubuntu1.11"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.20.3-0ubuntu1.11"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.20.3-0ubuntu1.11"
        },
        {
            "binary_name": "libgstreamer-plugins-good1.0-0",
            "binary_version": "1.20.3-0ubuntu1.11"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:24.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.22.6-1ubuntu1

1.22.6-1ubuntu2

1.22.8-3ubuntu1

1.22.9-1ubuntu1

1.24.0-1ubuntu5

1.24.0-1ubuntu7

1.24.1-2ubuntu1

1.24.2-1ubuntu1

1.24.2-1ubuntu1.1

1.24.2-1ubuntu1.2

1.24.2-1ubuntu1.3

1.24.2-1ubuntu1.4

1.24.2-1ubuntu1.5

1.24.2-1ubuntu1.6

1.24.2-1ubuntu1.7

1.24.2-1ubuntu1.8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.24.2-1ubuntu1.8"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.24.2-1ubuntu1.8"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.24.2-1ubuntu1.8"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.24.2-1ubuntu1.8"
        },
        {
            "binary_name": "gstreamer1.0-qt6",
            "binary_version": "1.24.2-1ubuntu1.8"
        },
        {
            "binary_name": "libgstreamer-plugins-good1.0-0",
            "binary_version": "1.24.2-1ubuntu1.8"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:26.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.5-1ubuntu2

1.27.2-1ubuntu1

1.27.90-1ubuntu1

1.28.0-1ubuntu1

1.28.0-1ubuntu3

1.28.1-1ubuntu1

1.28.2-2

1.28.2-2ubuntu0.1

1.28.2-2ubuntu0.2

1.28.2-2ubuntu0.3

1.28.2-2ubuntu0.4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.28.2-2ubuntu0.4"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.28.2-2ubuntu0.4"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.28.2-2ubuntu0.4"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.28.2-2ubuntu0.4"
        },
        {
            "binary_name": "gstreamer1.0-qt6",
            "binary_version": "1.28.2-2ubuntu0.4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:26.10

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.28.2-2

1.28.4-1

1.28.6-1

1.28.7-1

1.28.7-1build1

1.28.7-1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.28.7-1ubuntu0.1"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.28.7-1ubuntu0.1"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.28.7-1ubuntu0.1"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.28.7-1ubuntu0.1"
        },
        {
            "binary_name": "gstreamer1.0-qt6",
            "binary_version": "1.28.7-1ubuntu0.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:Pro:16.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.0-1ubuntu1

1.6.1-1ubuntu1

1.6.2-1ubuntu1

1.7.1-1ubuntu1

1.7.2-1ubuntu1

1.7.90-1ubuntu1

1.7.91-1ubuntu1

1.8.0-1ubuntu1

1.8.1-1ubuntu0.1

1.8.2-1ubuntu0.1

1.8.2-1ubuntu0.2

1.8.2-1ubuntu0.3

1.8.3-1ubuntu0.3

1.8.3-1ubuntu0.4

1.8.3-1ubuntu0.5

1.8.3-1ubuntu0.5+esm1

1.8.3-1ubuntu0.5+esm2

1.8.3-1ubuntu0.5+esm3

1.8.3-1ubuntu0.5+esm4

1.8.3-1ubuntu0.5+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.8.3-1ubuntu0.5+esm5"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.8.3-1ubuntu0.5+esm5"
        },
        {
            "binary_name": "libgstreamer-plugins-good1.0-0",
            "binary_version": "1.8.3-1ubuntu0.5+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:Pro:18.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.12.3-1ubuntu1

1.12.4-1ubuntu1

1.13.1-1ubuntu1

1.13.91-1ubuntu1

1.14.0-1ubuntu1

1.14.1-1ubuntu1~ubuntu18.04.1

1.14.4-1ubuntu1~ubuntu18.04.1

1.14.5-0ubuntu1~18.04.1

1.14.5-0ubuntu1~18.04.2

1.14.5-0ubuntu1~18.04.3

1.14.5-0ubuntu1~18.04.3+esm1

1.14.5-0ubuntu1~18.04.3+esm2

1.14.5-0ubuntu1~18.04.3+esm3

1.14.5-0ubuntu1~18.04.3+esm4

1.14.5-0ubuntu1~18.04.3+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.14.5-0ubuntu1~18.04.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.14.5-0ubuntu1~18.04.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.14.5-0ubuntu1~18.04.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.14.5-0ubuntu1~18.04.3+esm5"
        },
        {
            "binary_name": "libgstreamer-plugins-good1.0-0",
            "binary_version": "1.14.5-0ubuntu1~18.04.3+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"

Ubuntu:Pro:20.04:LTS

gst-plugins-good1.0

Package

Name: gst-plugins-good1.0
Purl: pkg:deb/ubuntu/gst-plugins-good1.0?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.16.1-1ubuntu1

1.16.2-1ubuntu1

1.16.2-1ubuntu2

1.16.2-1ubuntu2.1

1.16.3-0ubuntu1

1.16.3-0ubuntu1.1

1.16.3-0ubuntu1.2

1.16.3-0ubuntu1.3

1.16.3-0ubuntu1.3+esm1

1.16.3-0ubuntu1.3+esm2

1.16.3-0ubuntu1.3+esm3

1.16.3-0ubuntu1.3+esm4

1.16.3-0ubuntu1.3+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-gtk3",
            "binary_version": "1.16.3-0ubuntu1.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-plugins-good",
            "binary_version": "1.16.3-0ubuntu1.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-pulseaudio",
            "binary_version": "1.16.3-0ubuntu1.3+esm5"
        },
        {
            "binary_name": "gstreamer1.0-qt5",
            "binary_version": "1.16.3-0ubuntu1.3+esm5"
        },
        {
            "binary_name": "libgstreamer-plugins-good1.0-0",
            "binary_version": "1.16.3-0ubuntu1.3+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121629.json"