{"id":"CLSA-2026-1792532987","summary":"gstreamer1-plugins-good: Fix of 4 CVEs","details":"- rebase onto Oracle 1.10.4-2.0.7.el7_9\n- the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296\n  (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle\n  format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay:\n  check that enough data is available in the adapter)\n- keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the\n  output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize,\n  which the vendor's backport leaves in 32-bit arithmetic on this branch\n- keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX\n  offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port\n- keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than\n  Oracle's \u003c= 1.25.1, which no i686 buildroot can satisfy\n- renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle\n  took 1008 and 1009 for its own patches in this build\n- keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from\n  1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since\n  Oracle took 1010 in this build","modified":"2026-10-26T09:31:57.127460554Z","published":"2026-10-21T08:15:45Z","upstream":["CVE-2026-18295","CVE-2026-18296","CVE-2026-18298","CVE-2026-18299","CVE-2026-73433","CVE-2026-73434"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792532987.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18295"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18296"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18298"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18299"}],"affected":[{"package":{"name":"gstreamer1-plugins-good","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/gstreamer1-plugins-good?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.7.el7_9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792532987.json"}}],"schema_version":"1.9.0"}