{"id":"CLSA-2026-1792021687","summary":"gstreamer1-plugins-good: Fix of 4 CVEs","details":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","modified":"2026-10-26T09:43:54.479409394Z","published":"2026-10-17T13:05:05Z","upstream":["CVE-2024-47540","CVE-2024-47606","CVE-2024-47607","CVE-2024-47613","CVE-2026-53705"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792021687.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53705"}],"affected":[{"package":{"name":"gstreamer1-plugins-good","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/gstreamer1-plugins-good?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1792021687.json"}}],"schema_version":"1.9.0"}