CVE-2021-3185

GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\r\n\r\n Security Fix(es):\r\n\r\n A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.(CVE-2021-3185)\r\n\r\n

GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.

Security Fix(es):

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.(CVE-2021-3185)

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution. (CVE-2021-3185).

This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:

gstreamer was updated to version 1.16.3 (bsc#1181255):

• delay creation of threadpools
• bin: Fix deep-element-removed log message
• buffer: fix meta sequence number fallback on rpi
• bufferlist: foreach: always remove as parent if buffer is changed
• bus: Make setting/replacing/clearing the sync handler thread-safe
• elementfactory: Fix missing features in case a feature moves to another filename
• element: When removing a ghost pad also unset its target
• meta: intern registered impl string
• registry: Use a toolchain-specific registry file on Windows
• systemclock: Invalid internal time calculation causes non-increasing clock time on Windows
• value: don't write to const char *
• value: Fix segfault comparing empty GValueArrays
• Revert floating enforcing
• aggregator: fix iteration direction in skip_buffers
• sparsefile: fix possible crash when seeking
• baseparse: cache fix
• baseparse: fix memory leak when subclass skips whole input buffer
• baseparse: Set the private duration before posting a duration-changed message
• basetransform: allow not passthrough if generate_output is implemented
• identity: Fix a minor leak using meta_str
• queue: protect against lost wakeups for iterm_del condition
• queue2: Avoid races when posting buffering messages
• queue2: Fix missing/dropped buffering messages at startup
• identity: Unblock condition variable on FLUSH_START
• check: Use g_thread_yield() instead of g_usleep(1)
• tests: use cpu_family for arch checks
• gst-launch: Follow up to missing s/g_print/gst_print/g
• gst-inspect: Add define guard for g_log_writer_supports_color()
• gst-launch: go back down to GST_STATE_NULL in one step.
• device-monitor: list hidden providers before listing devices
• autotools build fixes for GNU make 4.3

gstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):

• deinterlace: on-the-fly renegotiation
• flacenc: Pass audio info from set_format() to query_total_samples() explicitly
• flacparse: fix broken reordering of flac metadata
• jack: Use jack_free(3) to release ports
• jpegdec: check buffer size before dereferencing
• pulse: fix discovery of newly added devices
• qtdemux fuzzing fixes
• qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now
• qtdemux: Specify REDIRECT information in error message
• rtpbin: fix shutdown crash in rtpbin
• rtpsession: rename RTCP thread
• rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()
• rtpjpegdepay: outputs framed jpeg
• rtpjitterbuffer: Properly free internal packets queue in finalize()
• rtspsrc: Don't return TRUE for unhandled query
• rtspsrc: Avoid stack overflow recursing waiting for response
• rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property
• rtspsrc: Error out when failling to receive message response
• rtspsrc: Fix for segmentation fault when handling set/get_parameter requests
• speex: Fix crash on Windows caused by cross-CRT issue
• speexdec: Crash when stopping the pipeline
• splitmuxsrc: Properly stop the loop if no part reader is present
• use gst_element_class_set_metadata when passing dynamic strings
• v4l2videodec: Increase internal bitstream pool size
• v4l2: fix crash when handling unsupported video format
• videocrop: allow properties to be animated by GstController
• videomixer: Don't leak peer caps
• vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD
• wavenc: Fix writing of the channel mask with >2 channels

gstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):

• amcvideodec: fix sync meta copying not taking a reference
• audiobuffersplit: Perform discont tracking on running time
• audiobuffersplit: Specify in the template caps that only interleaved audio is supported
• audiobuffersplit: Unset DISCONT flag if not discontinuous
• autoconvert: Fix lock-less exchange or free condition -…

This update for gstreamer-plugins-bad fixes the following issues:

• Update to version 1.16.3:
• CVE-2021-3185: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking() (bsc#1181255)
• amcvideodec: fix sync meta copying not taking a reference
• audiobuffersplit: Perform discont tracking on running time
• audiobuffersplit: Specify in the template caps that only interleaved audio is supported
• audiobuffersplit: Unset DISCONT flag if not discontinuous
• autoconvert: Fix lock-less exchange or free condition
• autoconvert: fix compiler warnings with g_atomic on recent GLib versions
• avfvideosrc: element requests camera permissions even with capture-screen property is true
• codecparsers: h264parser: guard against ref_pic_markings overflow
• dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated
• dtls/connection: fix EOF handling with openssl 1.1.1e
• fdkaacdec: add support for mpegversion=2
• hls: Check nettle version to ensure AES128 support
• ipcpipeline: Rework compiler checks
• interlace: Increment phase_index before checking if we're at the end of the phase
• h264parser: Do not allocate too large size of memory for registered user data SEI
• ladspa: fix unbounded integer properties
• modplug: avoid division by zero
• msdkdec: Fix GstMsdkContext leak
• msdkenc: fix leaks on windows
• musepackdec: Don't fail all queries if no sample rate is known yet
• openslessink: Allow openslessink to handle 48kHz streams.
• opencv: allow compilation against 4.2.x
• proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc
• vulkan: Drop use of VK_RESULT_BEGIN_RANGE
• wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset
• wasapi: Fix possible deadlock while downwards state change
• waylandsink: Clear window when pipeline is stopped
• webrtc: Support non-trickle ICE candidates in the SDP
• webrtc: Unmap all non-binary buffers received via the datachannel

This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:

gstreamer was updated to version 1.16.3 (bsc#1181255):

• delay creation of threadpools
• bin: Fix deep-element-removed log message
• buffer: fix meta sequence number fallback on rpi
• bufferlist: foreach: always remove as parent if buffer is changed
• bus: Make setting/replacing/clearing the sync handler thread-safe
• elementfactory: Fix missing features in case a feature moves to another filename
• element: When removing a ghost pad also unset its target
• meta: intern registered impl string
• registry: Use a toolchain-specific registry file on Windows
• systemclock: Invalid internal time calculation causes non-increasing clock time on Windows
• value: don't write to const char *
• value: Fix segfault comparing empty GValueArrays
• Revert floating enforcing
• aggregator: fix iteration direction in skip_buffers
• sparsefile: fix possible crash when seeking
• baseparse: cache fix
• baseparse: fix memory leak when subclass skips whole input buffer
• baseparse: Set the private duration before posting a duration-changed message
• basetransform: allow not passthrough if generate_output is implemented
• identity: Fix a minor leak using meta_str
• queue: protect against lost wakeups for iterm_del condition
• queue2: Avoid races when posting buffering messages
• queue2: Fix missing/dropped buffering messages at startup
• identity: Unblock condition variable on FLUSH_START
• check: Use g_thread_yield() instead of g_usleep(1)
• tests: use cpu_family for arch checks
• gst-launch: Follow up to missing s/g_print/gst_print/g
• gst-inspect: Add define guard for g_log_writer_supports_color()
• gst-launch: go back down to GST_STATE_NULL in one step.
• device-monitor: list hidden providers before listing devices
• autotools build fixes for GNU make 4.3

gstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):

• deinterlace: on-the-fly renegotiation
• flacenc: Pass audio info from set_format() to query_total_samples() explicitly
• flacparse: fix broken reordering of flac metadata
• jack: Use jack_free(3) to release ports
• jpegdec: check buffer size before dereferencing
• pulse: fix discovery of newly added devices
• qtdemux fuzzing fixes
• qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now
• qtdemux: Specify REDIRECT information in error message
• rtpbin: fix shutdown crash in rtpbin
• rtpsession: rename RTCP thread
• rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()
• rtpjpegdepay: outputs framed jpeg
• rtpjitterbuffer: Properly free internal packets queue in finalize()
• rtspsrc: Don't return TRUE for unhandled query
• rtspsrc: Avoid stack overflow recursing waiting for response
• rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property
• rtspsrc: Error out when failling to receive message response
• rtspsrc: Fix for segmentation fault when handling set/get_parameter requests
• speex: Fix crash on Windows caused by cross-CRT issue
• speexdec: Crash when stopping the pipeline
• splitmuxsrc: Properly stop the loop if no part reader is present
• use gst_element_class_set_metadata when passing dynamic strings
• v4l2videodec: Increase internal bitstream pool size
• v4l2: fix crash when handling unsupported video format
• videocrop: allow properties to be animated by GstController
• videomixer: Don't leak peer caps
• vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD
• wavenc: Fix writing of the channel mask with >2 channels

gstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):

• amcvideodec: fix sync meta copying not taking a reference
• audiobuffersplit: Perform discont tracking on running time
• audiobuffersplit: Specify in the template caps that only interleaved audio is supported
• audiobuffersplit: Unset DISCONT flag if not discontinuous
• autoconvert: Fix lock-less exchange or free condition -…

These are all security issues fixed in the gstreamer-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-plugins-base-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-plugins-good-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-plugins-bad-1.18.5-5.1 package on the GA media of openSUSE Tumbleweed.

This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:

gstreamer was updated to version 1.16.3 (bsc#1181255):

• delay creation of threadpools
• bin: Fix deep-element-removed log message
• buffer: fix meta sequence number fallback on rpi
• bufferlist: foreach: always remove as parent if buffer is changed
• bus: Make setting/replacing/clearing the sync handler thread-safe
• elementfactory: Fix missing features in case a feature moves to another filename
• element: When removing a ghost pad also unset its target
• meta: intern registered impl string
• registry: Use a toolchain-specific registry file on Windows
• systemclock: Invalid internal time calculation causes non-increasing clock time on Windows
• value: don't write to const char *
• value: Fix segfault comparing empty GValueArrays
• Revert floating enforcing
• aggregator: fix iteration direction in skip_buffers
• sparsefile: fix possible crash when seeking
• baseparse: cache fix
• baseparse: fix memory leak when subclass skips whole input buffer
• baseparse: Set the private duration before posting a duration-changed message
• basetransform: allow not passthrough if generate_output is implemented
• identity: Fix a minor leak using meta_str
• queue: protect against lost wakeups for iterm_del condition
• queue2: Avoid races when posting buffering messages
• queue2: Fix missing/dropped buffering messages at startup
• identity: Unblock condition variable on FLUSH_START
• check: Use g_thread_yield() instead of g_usleep(1)
• tests: use cpu_family for arch checks
• gst-launch: Follow up to missing s/g_print/gst_print/g
• gst-inspect: Add define guard for g_log_writer_supports_color()
• gst-launch: go back down to GST_STATE_NULL in one step.
• device-monitor: list hidden providers before listing devices
• autotools build fixes for GNU make 4.3

gstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):

• deinterlace: on-the-fly renegotiation
• flacenc: Pass audio info from set_format() to query_total_samples() explicitly
• flacparse: fix broken reordering of flac metadata
• jack: Use jack_free(3) to release ports
• jpegdec: check buffer size before dereferencing
• pulse: fix discovery of newly added devices
• qtdemux fuzzing fixes
• qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now
• qtdemux: Specify REDIRECT information in error message
• rtpbin: fix shutdown crash in rtpbin
• rtpsession: rename RTCP thread
• rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()
• rtpjpegdepay: outputs framed jpeg
• rtpjitterbuffer: Properly free internal packets queue in finalize()
• rtspsrc: Don't return TRUE for unhandled query
• rtspsrc: Avoid stack overflow recursing waiting for response
• rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property
• rtspsrc: Error out when failling to receive message response
• rtspsrc: Fix for segmentation fault when handling set/get_parameter requests
• speex: Fix crash on Windows caused by cross-CRT issue
• speexdec: Crash when stopping the pipeline
• splitmuxsrc: Properly stop the loop if no part reader is present
• use gst_element_class_set_metadata when passing dynamic strings
• v4l2videodec: Increase internal bitstream pool size
• v4l2: fix crash when handling unsupported video format
• videocrop: allow properties to be animated by GstController
• videomixer: Don't leak peer caps
• vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD
• wavenc: Fix writing of the channel mask with >2 channels

gstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):

• amcvideodec: fix sync meta copying not taking a reference
• audiobuffersplit: Perform discont tracking on running time
• audiobuffersplit: Specify in the template caps that only interleaved audio is supported
• audiobuffersplit: Unset DISCONT flag if not discontinuous
• autoconvert: Fix lock-less exchange or free condition -…

This update for gstreamer-plugins-bad fixes the following issues:

• CVE-2021-3185: Fixed buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking (bsc#1181255).

This update for gstreamer-plugins-bad fixes the following issues:

• CVE-2021-3185: Fixed buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking (bsc#1181255).

This update for gstreamer-plugins-bad fixes the following issues:

• CVE-2021-3185: h264parser: guard against ref_pic_markings overflow (bsc#1181255

This update for gstreamer-plugins-bad fixes the following issues:

• Update to version 1.16.3:
• CVE-2021-3185: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking() (bsc#1181255)
• amcvideodec: fix sync meta copying not taking a reference
• audiobuffersplit: Perform discont tracking on running time
• audiobuffersplit: Specify in the template caps that only interleaved audio is supported
• audiobuffersplit: Unset DISCONT flag if not discontinuous
• autoconvert: Fix lock-less exchange or free condition
• autoconvert: fix compiler warnings with g_atomic on recent GLib versions
• avfvideosrc: element requests camera permissions even with capture-screen property is true
• codecparsers: h264parser: guard against ref_pic_markings overflow
• dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated
• dtls/connection: fix EOF handling with openssl 1.1.1e
• fdkaacdec: add support for mpegversion=2
• hls: Check nettle version to ensure AES128 support
• ipcpipeline: Rework compiler checks
• interlace: Increment phase_index before checking if we're at the end of the phase
• h264parser: Do not allocate too large size of memory for registered user data SEI
• ladspa: fix unbounded integer properties
• modplug: avoid division by zero
• msdkdec: Fix GstMsdkContext leak
• msdkenc: fix leaks on windows
• musepackdec: Don't fail all queries if no sample rate is known yet
• openslessink: Allow openslessink to handle 48kHz streams.
• opencv: allow compilation against 4.2.x
• proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc
• vulkan: Drop use of VK_RESULT_BEGIN_RANGE
• wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset
• wasapi: Fix possible deadlock while downwards state change
• waylandsink: Clear window when pipeline is stopped
• webrtc: Support non-trickle ICE candidates in the SDP
• webrtc: Unmap all non-binary buffers received via the datachannel