{"id":"CLSA-2026-1790671701","summary":"gstreamer1-plugins-good: Fix of 5 CVEs","details":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","modified":"2026-10-26T09:43:38.446466432Z","published":"2026-09-29T08:48:29Z","upstream":["CVE-2024-47540","CVE-2024-47606","CVE-2024-47607","CVE-2024-47613","CVE-2026-53705"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790671701.html"}],"affected":[{"package":{"name":"gstreamer1-plugins-good","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/gstreamer1-plugins-good?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7_9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1790671701.json"}}],"schema_version":"1.9.0"}