Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CentOS GStreamer plugins can cause crashes or attacks

published 14 days ago

Summary

The GStreamer plugins for CentOS that handle JPEG images and secure connections have bugs that could let a program crash or be taken over. Updating the affected packages to the latest versions fixes these issues and protects your systems.

What to do

Update centos gstreamer1-plugins-bad-free to version 1.10.4-4.el7_9.tuxcare.els2.
Update centos gstreamer1-plugins-bad-free-devel to version 1.10.4-4.el7_9.tuxcare.els2.
Update centos gstreamer1-plugins-bad-free-gtk to version 1.10.4-4.el7_9.tuxcare.els2.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:CentOS:7	centos	gstreamer1-plugins-bad-free	< 1.10.4-4.el7_9.tuxcare.els2 Fix: upgrade to 1.10.4-4.el7_9.tuxcare.els2
TuxCare:CentOS:7	centos	gstreamer1-plugins-bad-free-devel	< 1.10.4-4.el7_9.tuxcare.els2 Fix: upgrade to 1.10.4-4.el7_9.tuxcare.els2
TuxCare:CentOS:7	centos	gstreamer1-plugins-bad-free-gtk	< 1.10.4-4.el7_9.tuxcare.els2 Fix: upgrade to 1.10.4-4.el7_9.tuxcare.els2

Original advisory text

gstreamer1-plugins-bad-free: Fix of 2 CVEs

- CVE-2026-3082: jpegparser: fix heap buffer overflow by checking the Huffman
table length against its storage before copying it
- CVE-2026-59692: dtls: fix stack buffer overflow by allocating the buffer
for the peer certificate subject DN to its printed length

References

https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792562667.html Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3082 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-59692 Vendor Advisory

Timeline

Published21 Oct 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1792562667 · OSV

Track software like this

Free during beta