{"id":"CVE-2021-3185","aliases":["DEBIAN-CVE-2021-3185","DLA-2528-1","DSA-4833-1","EUVD-2021-26528","GHSA-fr84-36xq-g72g","MGASA-2021-0079","OESA-2021-1035","OESA-2021-1047","SUSE-SU-2021:1819-1","SUSE-SU-2021:1873-1","SUSE-SU-2021:1875-1","SUSE-SU-2021:1904-1","SUSE-SU-2021:1944-1","UBUNTU-CVE-2021-3185","openSUSE-SU-2021:0822-1","openSUSE-SU-2021:1012-1","openSUSE-SU-2021:1819-1","openSUSE-SU-2024:11776-1","openSUSE-SU-2024:11777-1","openSUSE-SU-2024:11778-1","openSUSE-SU-2024:11782-1"],"status":"published","title":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when...","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0248,"percentile":0.84712,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2021-01-18T00:00:00Z","modified":"2026-10-24T10:30:57Z","fixes":[{"ecosystem":"Debian:12","package":"gst-plugins-bad1.0","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-bad1.0","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-bad1.0","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gst-plugins-bad1.0","fixed_in":["1.10.4-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"gst-plugins-bad1.0","fixed_in":["1.14.4-1deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","fixed_in":["1.16.0-1.1.mga7","1.16.0-1.1.mga7.tainted"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"gstreamer1-plugins-bad-free","fixed_in":["1.16.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer1-plugins-bad-free","fixed_in":["1.16.2-2.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-4.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-good","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-good","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-4.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"gstreamer-plugins-ugly","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"gstreamer-plugins-ugly","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-plugins-bad","fixed_in":["1.2.4-3.7.1","1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-bad","fixed_in":["1.8.3-18.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"gstreamer-plugins-bad","fixed_in":["1.12.5-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-9.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gstreamer","fixed_in":["1.16.3-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-lp152.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-lp152.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-good","fixed_in":["1.16.3-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-ugly","fixed_in":["1.16.3-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-bad","fixed_in":["1.16.3-lp153.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-good","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-ugly","fixed_in":["1.16.3-3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1+deb9u1"}]}],"versions":["1.10.4-1"]},{"source":"osv","ecosystem":"Debian:10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-1deb10u1"}]}],"versions":["1.14.4-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1.1.mga7.tainted"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"gstreamer-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"gstreamer-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-9.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3ubuntu5","1.2.1-1ubuntu1","1.2.1-1ubuntu2","1.2.2-1ubuntu1","1.2.2-1ubuntu2","1.2.2-1ubuntu4","1.2.3-1ubuntu1","1.2.3-1ubuntu2","1.2.4-1~ubuntu1","1.2.4-1~ubuntu1.1","1.2.4-1~ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.2-1ubuntu1","1.7.90-1ubuntu2","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.2+esm1","1.8.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.3-1ubuntu2","1.12.3-2ubuntu1","1.12.4-2ubuntu1","1.12.4-2ubuntu2","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.1+esm1","1.14.5-0ubuntu1~18.04.1+esm2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp153.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.1"}]}]}],"products":[{"vendor":"freedesktop","product":"gst-plugins-bad"},{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917192","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202208-31","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3185","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fr84-36xq-g72g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3185","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0079.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28174","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-4833","tags":["web"]},{"url":"https://seclists.org/oss-sec/2021/q1/59","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1035","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1047","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211819-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181255","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211873-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211904-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211944-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3185","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/20/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3185","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WTUD7F7CVHXB4OCLI7OT4AVJTO6T64TM/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2B2UD46YGBOYO64SOPMOM6DQAL6FGCHZ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4DDS7NLC6D7UVP25OVRWIRK6Y44WZKCU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3498","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3185","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-25T16:33:15Z","modified":"2024-08-03T16:45:51.407Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26528","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-25T16:33:15Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-fr84-36xq-g72g","title":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when...","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2022-05-24T17:40:23Z","modified":"2023-01-27T05:02:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:42:05.364036Z"}],"nvd":[{"id":"CVE-2021-3185","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-26T18:16:28.067Z","modified":"2026-06-17T04:04:48.523Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-3185","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-26T18:16:28.067Z","modified":"2026-10-24T10:30:57.222380095Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-3185","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-26T18:16:28.067Z","modified":"2026-10-23T18:03:26.621806311Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1035","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\\r\\n\\r\\n\r\nSecurity Fix(es):\\r\\n\\r\\n\r\nA flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.(CVE-2021-3185)\\r\\n\\r\\n","status":"published","published":"2021-02-10T11:04:16Z","modified":"2026-08-18T01:15:06.056689332Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2021-1047","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\n\r\nSecurity Fix(es):\n\r\nA flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.(CVE-2021-3185)","status":"published","published":"2021-03-05T11:04:16Z","modified":"2026-08-18T01:15:13.978940554Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-3185","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.","status":"published","published":"2021-01-26T18:16:00Z","modified":"2026-10-01T00:19:14.615917386Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"DLA-2528-1","title":"gst-plugins-bad1.0 - security update","status":"published","published":"2021-01-19T00:00:00Z","modified":"2026-03-09T01:23:32.150018Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4833-1","title":"gst-plugins-bad1.0 - security update","status":"published","published":"2021-01-18T00:00:00Z","modified":"2026-03-09T02:08:57.635686Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0079","title":"Updated gstreamer1.0-plugins-bad packages fix security vulnerability","description":"A flaw was found in the gstreamer h264 component of gst-plugins-bad before\nv1.18.1 where when parsing a h264 header, an attacker could cause the stack to\nbe smashed, memory corruption and possibly code execution. (CVE-2021-3185).\n","status":"published","published":"2021-02-10T18:41:52Z","modified":"2026-04-16T04:43:13.332331061Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0822-1","title":"Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly","description":"This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:\n\ngstreamer was updated to version 1.16.3 (bsc#1181255):\n\n- delay creation of threadpools\n- bin: Fix `deep-element-removed` log message\n- buffer: fix meta sequence number fallback on rpi\n- bufferlist: foreach: always remove as parent if buffer is changed\n- bus: Make setting/replacing/clearing the sync handler thread-safe\n- elementfactory: Fix missing features in case a feature moves to another filename\n- element: When removing a ghost pad also unset its target\n- meta: intern registered impl string\n- registry: Use a toolchain-specific registry file on Windows\n- systemclock: Invalid internal time calculation causes non-increasing clock time on Windows\n- value: don't write to `const char *`\n- value: Fix segfault comparing empty GValueArrays\n- Revert floating enforcing\n- aggregator: fix iteration direction in skip_buffers\n- sparsefile: fix possible crash when seeking\n- baseparse: cache fix\n- baseparse: fix memory leak when subclass skips whole input buffer\n- baseparse: Set the private duration before posting a duration-changed message\n- basetransform: allow not passthrough if generate_output is implemented\n- identity: Fix a minor leak using meta_str\n- queue: protect against lost wakeups for iterm_del condition\n- queue2: Avoid races when posting buffering messages\n- queue2: Fix missing/dropped buffering messages at startup\n- identity: Unblock condition variable on FLUSH_START\n- check: Use `g_thread_yield()` instead of `g_usleep(1)`\n- tests: use cpu_family for arch checks\n- gst-launch: Follow up to missing `s/g_print/gst_print/g`\n- gst-inspect: Add define guard for `g_log_writer_supports_color()`\n- gst-launch: go back down to `GST_STATE_NULL` in one step.\n- device-monitor: list hidden providers before listing devices\n- autotools build fixes for GNU make 4.3\n\ngstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):\n\n- deinterlace: on-the-fly renegotiation\n- flacenc: Pass audio info from set_format() to query_total_samples() explicitly\n- flacparse: fix broken reordering of flac metadata\n- jack: Use jack_free(3) to release ports\n- jpegdec: check buffer size before dereferencing\n- pulse: fix discovery of newly added devices\n- qtdemux fuzzing fixes\n- qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now\n- qtdemux: Specify REDIRECT information in error message\n- rtpbin: fix shutdown crash in rtpbin\n- rtpsession: rename RTCP thread\n- rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()\n- rtpjpegdepay: outputs framed jpeg\n- rtpjitterbuffer: Properly free internal packets queue in finalize()\n- rtspsrc: Don't return TRUE for unhandled query\n- rtspsrc: Avoid stack overflow recursing waiting for response\n- rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property\n- rtspsrc: Error out when failling to receive message response\n- rtspsrc: Fix for segmentation fault when handling set/get_parameter requests\n- speex: Fix crash on Windows caused by cross-CRT issue\n- speexdec: Crash when stopping the pipeline\n- splitmuxsrc: Properly stop the loop if no part reader is present\n- use gst_element_class_set_metadata when passing dynamic strings\n- v4l2videodec: Increase internal bitstream pool size\n- v4l2: fix crash when handling unsupported video format\n- videocrop: allow properties to be animated by GstController\n- videomixer: Don't leak peer caps\n- vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD\n- wavenc: Fix writing of the channel mask with \u003e2 channels\n\ngstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):\n\n- amcvideodec: fix sync meta copying not taking a reference\n- audiobuffersplit: Perform discont tracking on running time\n- audiobuffersplit: Specify in the template caps that only interleaved audio is supported\n- audiobuffersplit: Unset DISCONT flag if not discontinuous\n- autoconvert: Fix lock-less exchange or free condition\n- autoconvert: fix compiler warnings with g_atomic on recent GLib versions\n- avfvideosrc: element requests camera permissions even with capture-screen property is true\n- codecparsers: h264parser: guard against ref_pic_markings overflow\n- dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated\n- dtls/connection: fix EOF handling with openssl 1.1.1e\n- fdkaacdec: add support for mpegversion=2\n- hls: Check nettle version to ensure AES128 support\n- ipcpipeline: Rework compiler checks\n- interlace: Increment phase_index before checking if we're at the end of the phase\n- lv2: Make it build with -fno-common\n- h264parser: Do not allocate too large size of memory for registered user data SEI\n- ladspa: fix unbounded integer properties\n- modplug: avoid division by zero\n- msdkdec: Fix GstMsdkContext leak\n- msdkenc: fix leaks on windows\n- musepackdec: Don't fail all queries if no sample rate is known yet\n- openslessink: Allow openslessink to handle 48kHz streams.\n- opencv: allow compilation against 4.2.x\n- proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc\n- vulkan: Drop use of VK_RESULT_BEGIN_RANGE\n- wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset\n- wasapi: Fix possible deadlock while downwards state change\n- waylandsink: Clear window when pipeline is stopped\n- webrtc: Support non-trickle ICE candidates in the SDP\n- webrtc: Unmap all non-binary buffers received via the datachannel\n- meson: build with neon 0.31\n- Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch\n\n- h264parser: guard against ref_pic_markings overflow\n  (bsc#1181255 CVE-2021-3185)\n\n- Disable the kate/libtiger plugin.  Kate streams for karaoke are not\n  used anymore, and the source tarball for libtiger is no longer\n  available upstream. (jsc#SLE-13843)\n\ngstreamer-plugins-ugly was updated to version 1.16.3 (bsc#1181255):\n\n+ x264enc: corrected em_data value in CEA-708 CC SEI message\n\ngstreamer-plugins-base was updated to version 1.16.3 (bsc#1181255):\n\n- audioaggregator: Check all downstream allowed caps structures if they support the upstream rate\n- audioaggregator: Fix negotiation with downstream if there is no peer yet\n- audioencoder: fix segment event leak\n- discoverer: Fix caps handling in `pad-added` signal handler\n- discoverer: Start discovering next URI from right thread\n- fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things\n- gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)\n- gl/display/egl: ensure debug category is initialized\n- gstglwindow_x11: fix resize\n- pbutils: Add latest H.264 level values\n- rtpbuffer: fix header extension length validation\n- video: Fix NV12_64Z32 number of component\n- video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5\n- video: fix top/bottom field flags\n- videodecoder: don't copy interlace-mode from reference state\n- appsrc/appsink: Make setting/replacing callbacks thread-safe\n- compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU\n- decodebin3: only force streams-selected seqnum after a select-streams\n- glupload: Fix fallback from direct dmabuf to dmabuf upload method\n- glvideomixer: perform `_get_highest_precision()` on the GL thread\n- libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings\n- oggstream: Workaround for broken PAR in VP8 BOS\n- subparse: accept WebVTT timestamps without an hour component\n- playbin: Handle error message with redirection indication\n- textrender: Fix AYUV output.\n- typefind: Consider MPEG-PS PSM to be a PES type\n- uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time\n- videoaggregator: Don't configure NULL chroma-site/colorimetry\n- videorate/videoscale/audioresample: Ensure that the caps returned from...\n- build: Replace bashisms in configure for Wayland and GLES3\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-06-01T15:52:21Z","modified":"2026-02-04T02:50:33.361011Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1012-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- Update to version 1.16.3:\n - CVE-2021-3185: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking() (bsc#1181255)\n - amcvideodec: fix sync meta copying not taking a reference\n - audiobuffersplit: Perform discont tracking on running time\n - audiobuffersplit: Specify in the template caps that only interleaved audio is supported\n - audiobuffersplit: Unset DISCONT flag if not discontinuous\n - autoconvert: Fix lock-less exchange or free condition\n - autoconvert: fix compiler warnings with g_atomic on recent GLib versions\n - avfvideosrc: element requests camera permissions even with capture-screen property is true\n - codecparsers: h264parser: guard against ref_pic_markings overflow\n - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated\n - dtls/connection: fix EOF handling with openssl 1.1.1e\n - fdkaacdec: add support for mpegversion=2\n - hls: Check nettle version to ensure AES128 support\n - ipcpipeline: Rework compiler checks\n - interlace: Increment phase_index before checking if we're at the end of the phase\n - h264parser: Do not allocate too large size of memory for registered user data SEI\n - ladspa: fix unbounded integer properties\n - modplug: avoid division by zero\n - msdkdec: Fix GstMsdkContext leak\n - msdkenc: fix leaks on windows\n - musepackdec: Don't fail all queries if no sample rate is known yet\n - openslessink: Allow openslessink to handle 48kHz streams.\n - opencv: allow compilation against 4.2.x\n - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc\n - vulkan: Drop use of VK_RESULT_BEGIN_RANGE\n - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset\n - wasapi: Fix possible deadlock while downwards state change\n - waylandsink: Clear window when pipeline is stopped\n - webrtc: Support non-trickle ICE candidates in the SDP\n - webrtc: Unmap all non-binary buffers received via the datachannel\n","status":"published","published":"2021-07-09T11:04:33Z","modified":"2026-02-04T03:44:32.020138Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1819-1","title":"Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly","description":"This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:\n\ngstreamer was updated to version 1.16.3 (bsc#1181255):\n\n- delay creation of threadpools\n- bin: Fix `deep-element-removed` log message\n- buffer: fix meta sequence number fallback on rpi\n- bufferlist: foreach: always remove as parent if buffer is changed\n- bus: Make setting/replacing/clearing the sync handler thread-safe\n- elementfactory: Fix missing features in case a feature moves to another filename\n- element: When removing a ghost pad also unset its target\n- meta: intern registered impl string\n- registry: Use a toolchain-specific registry file on Windows\n- systemclock: Invalid internal time calculation causes non-increasing clock time on Windows\n- value: don't write to `const char *`\n- value: Fix segfault comparing empty GValueArrays\n- Revert floating enforcing\n- aggregator: fix iteration direction in skip_buffers\n- sparsefile: fix possible crash when seeking\n- baseparse: cache fix\n- baseparse: fix memory leak when subclass skips whole input buffer\n- baseparse: Set the private duration before posting a duration-changed message\n- basetransform: allow not passthrough if generate_output is implemented\n- identity: Fix a minor leak using meta_str\n- queue: protect against lost wakeups for iterm_del condition\n- queue2: Avoid races when posting buffering messages\n- queue2: Fix missing/dropped buffering messages at startup\n- identity: Unblock condition variable on FLUSH_START\n- check: Use `g_thread_yield()` instead of `g_usleep(1)`\n- tests: use cpu_family for arch checks\n- gst-launch: Follow up to missing `s/g_print/gst_print/g`\n- gst-inspect: Add define guard for `g_log_writer_supports_color()`\n- gst-launch: go back down to `GST_STATE_NULL` in one step.\n- device-monitor: list hidden providers before listing devices\n- autotools build fixes for GNU make 4.3\n\ngstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):\n\n- deinterlace: on-the-fly renegotiation\n- flacenc: Pass audio info from set_format() to query_total_samples() explicitly\n- flacparse: fix broken reordering of flac metadata\n- jack: Use jack_free(3) to release ports\n- jpegdec: check buffer size before dereferencing\n- pulse: fix discovery of newly added devices\n- qtdemux fuzzing fixes\n- qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now\n- qtdemux: Specify REDIRECT information in error message\n- rtpbin: fix shutdown crash in rtpbin\n- rtpsession: rename RTCP thread\n- rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()\n- rtpjpegdepay: outputs framed jpeg\n- rtpjitterbuffer: Properly free internal packets queue in finalize()\n- rtspsrc: Don't return TRUE for unhandled query\n- rtspsrc: Avoid stack overflow recursing waiting for response\n- rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property\n- rtspsrc: Error out when failling to receive message response\n- rtspsrc: Fix for segmentation fault when handling set/get_parameter requests\n- speex: Fix crash on Windows caused by cross-CRT issue\n- speexdec: Crash when stopping the pipeline\n- splitmuxsrc: Properly stop the loop if no part reader is present\n- use gst_element_class_set_metadata when passing dynamic strings\n- v4l2videodec: Increase internal bitstream pool size\n- v4l2: fix crash when handling unsupported video format\n- videocrop: allow properties to be animated by GstController\n- videomixer: Don't leak peer caps\n- vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD\n- wavenc: Fix writing of the channel mask with \u003e2 channels\n\ngstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):\n\n- amcvideodec: fix sync meta copying not taking a reference\n- audiobuffersplit: Perform discont tracking on running time\n- audiobuffersplit: Specify in the template caps that only interleaved audio is supported\n- audiobuffersplit: Unset DISCONT flag if not discontinuous\n- autoconvert: Fix lock-less exchange or free condition\n- autoconvert: fix compiler warnings with g_atomic on recent GLib versions\n- avfvideosrc: element requests camera permissions even with capture-screen property is true\n- codecparsers: h264parser: guard against ref_pic_markings overflow\n- dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated\n- dtls/connection: fix EOF handling with openssl 1.1.1e\n- fdkaacdec: add support for mpegversion=2\n- hls: Check nettle version to ensure AES128 support\n- ipcpipeline: Rework compiler checks\n- interlace: Increment phase_index before checking if we're at the end of the phase\n- lv2: Make it build with -fno-common\n- h264parser: Do not allocate too large size of memory for registered user data SEI\n- ladspa: fix unbounded integer properties\n- modplug: avoid division by zero\n- msdkdec: Fix GstMsdkContext leak\n- msdkenc: fix leaks on windows\n- musepackdec: Don't fail all queries if no sample rate is known yet\n- openslessink: Allow openslessink to handle 48kHz streams.\n- opencv: allow compilation against 4.2.x\n- proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc\n- vulkan: Drop use of VK_RESULT_BEGIN_RANGE\n- wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset\n- wasapi: Fix possible deadlock while downwards state change\n- waylandsink: Clear window when pipeline is stopped\n- webrtc: Support non-trickle ICE candidates in the SDP\n- webrtc: Unmap all non-binary buffers received via the datachannel\n- meson: build with neon 0.31\n- Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch\n\n- h264parser: guard against ref_pic_markings overflow\n  (bsc#1181255 CVE-2021-3185)\n\n- Disable the kate/libtiger plugin.  Kate streams for karaoke are not\n  used anymore, and the source tarball for libtiger is no longer\n  available upstream. (jsc#SLE-13843)\n\ngstreamer-plugins-ugly was updated to version 1.16.3 (bsc#1181255):\n\n+ x264enc: corrected em_data value in CEA-708 CC SEI message\n\ngstreamer-plugins-base was updated to version 1.16.3 (bsc#1181255):\n\n- audioaggregator: Check all downstream allowed caps structures if they support the upstream rate\n- audioaggregator: Fix negotiation with downstream if there is no peer yet\n- audioencoder: fix segment event leak\n- discoverer: Fix caps handling in `pad-added` signal handler\n- discoverer: Start discovering next URI from right thread\n- fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things\n- gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)\n- gl/display/egl: ensure debug category is initialized\n- gstglwindow_x11: fix resize\n- pbutils: Add latest H.264 level values\n- rtpbuffer: fix header extension length validation\n- video: Fix NV12_64Z32 number of component\n- video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5\n- video: fix top/bottom field flags\n- videodecoder: don't copy interlace-mode from reference state\n- appsrc/appsink: Make setting/replacing callbacks thread-safe\n- compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU\n- decodebin3: only force streams-selected seqnum after a select-streams\n- glupload: Fix fallback from direct dmabuf to dmabuf upload method\n- glvideomixer: perform `_get_highest_precision()` on the GL thread\n- libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings\n- oggstream: Workaround for broken PAR in VP8 BOS\n- subparse: accept WebVTT timestamps without an hour component\n- playbin: Handle error message with redirection indication\n- textrender: Fix AYUV output.\n- typefind: Consider MPEG-PS PSM to be a PES type\n- uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time\n- videoaggregator: Don't configure NULL chroma-site/colorimetry\n- videorate/videoscale/audioresample: Ensure that the caps returned from...\n- build: Replace bashisms in configure for Wayland and GLES3\n","status":"published","published":"2021-07-11T12:54:38Z","modified":"2026-02-04T03:03:44.865319Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11776-1","title":"gstreamer-1.18.5-3.1 on GA media","description":"These are all security issues fixed in the gstreamer-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:57.903486Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11777-1","title":"gstreamer-plugins-base-1.18.5-3.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-base-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:01:25.371296Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11778-1","title":"gstreamer-plugins-good-1.18.5-3.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-good-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:16:09.380277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11782-1","title":"gstreamer-plugins-bad-1.18.5-5.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-bad-1.18.5-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:42:28.917254Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1819-1","title":"Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly","description":"This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues:\n\ngstreamer was updated to version 1.16.3 (bsc#1181255):\n\n- delay creation of threadpools\n- bin: Fix `deep-element-removed` log message\n- buffer: fix meta sequence number fallback on rpi\n- bufferlist: foreach: always remove as parent if buffer is changed\n- bus: Make setting/replacing/clearing the sync handler thread-safe\n- elementfactory: Fix missing features in case a feature moves to another filename\n- element: When removing a ghost pad also unset its target\n- meta: intern registered impl string\n- registry: Use a toolchain-specific registry file on Windows\n- systemclock: Invalid internal time calculation causes non-increasing clock time on Windows\n- value: don't write to `const char *`\n- value: Fix segfault comparing empty GValueArrays\n- Revert floating enforcing\n- aggregator: fix iteration direction in skip_buffers\n- sparsefile: fix possible crash when seeking\n- baseparse: cache fix\n- baseparse: fix memory leak when subclass skips whole input buffer\n- baseparse: Set the private duration before posting a duration-changed message\n- basetransform: allow not passthrough if generate_output is implemented\n- identity: Fix a minor leak using meta_str\n- queue: protect against lost wakeups for iterm_del condition\n- queue2: Avoid races when posting buffering messages\n- queue2: Fix missing/dropped buffering messages at startup\n- identity: Unblock condition variable on FLUSH_START\n- check: Use `g_thread_yield()` instead of `g_usleep(1)`\n- tests: use cpu_family for arch checks\n- gst-launch: Follow up to missing `s/g_print/gst_print/g`\n- gst-inspect: Add define guard for `g_log_writer_supports_color()`\n- gst-launch: go back down to `GST_STATE_NULL` in one step.\n- device-monitor: list hidden providers before listing devices\n- autotools build fixes for GNU make 4.3\n\ngstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255):\n\n- deinterlace: on-the-fly renegotiation\n- flacenc: Pass audio info from set_format() to query_total_samples() explicitly\n- flacparse: fix broken reordering of flac metadata\n- jack: Use jack_free(3) to release ports\n- jpegdec: check buffer size before dereferencing\n- pulse: fix discovery of newly added devices\n- qtdemux fuzzing fixes\n- qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now\n- qtdemux: Specify REDIRECT information in error message\n- rtpbin: fix shutdown crash in rtpbin\n- rtpsession: rename RTCP thread\n- rtpvp8pay, rtpvp9pay: fix caps leak in set_caps()\n- rtpjpegdepay: outputs framed jpeg\n- rtpjitterbuffer: Properly free internal packets queue in finalize()\n- rtspsrc: Don't return TRUE for unhandled query\n- rtspsrc: Avoid stack overflow recursing waiting for response\n- rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property\n- rtspsrc: Error out when failling to receive message response\n- rtspsrc: Fix for segmentation fault when handling set/get_parameter requests\n- speex: Fix crash on Windows caused by cross-CRT issue\n- speexdec: Crash when stopping the pipeline\n- splitmuxsrc: Properly stop the loop if no part reader is present\n- use gst_element_class_set_metadata when passing dynamic strings\n- v4l2videodec: Increase internal bitstream pool size\n- v4l2: fix crash when handling unsupported video format\n- videocrop: allow properties to be animated by GstController\n- videomixer: Don't leak peer caps\n- vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD\n- wavenc: Fix writing of the channel mask with \u003e2 channels\n\ngstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255):\n\n- amcvideodec: fix sync meta copying not taking a reference\n- audiobuffersplit: Perform discont tracking on running time\n- audiobuffersplit: Specify in the template caps that only interleaved audio is supported\n- audiobuffersplit: Unset DISCONT flag if not discontinuous\n- autoconvert: Fix lock-less exchange or free condition\n- autoconvert: fix compiler warnings with g_atomic on recent GLib versions\n- avfvideosrc: element requests camera permissions even with capture-screen property is true\n- codecparsers: h264parser: guard against ref_pic_markings overflow\n- dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated\n- dtls/connection: fix EOF handling with openssl 1.1.1e\n- fdkaacdec: add support for mpegversion=2\n- hls: Check nettle version to ensure AES128 support\n- ipcpipeline: Rework compiler checks\n- interlace: Increment phase_index before checking if we're at the end of the phase\n- lv2: Make it build with -fno-common\n- h264parser: Do not allocate too large size of memory for registered user data SEI\n- ladspa: fix unbounded integer properties\n- modplug: avoid division by zero\n- msdkdec: Fix GstMsdkContext leak\n- msdkenc: fix leaks on windows\n- musepackdec: Don't fail all queries if no sample rate is known yet\n- openslessink: Allow openslessink to handle 48kHz streams.\n- opencv: allow compilation against 4.2.x\n- proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc\n- vulkan: Drop use of VK_RESULT_BEGIN_RANGE\n- wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset\n- wasapi: Fix possible deadlock while downwards state change\n- waylandsink: Clear window when pipeline is stopped\n- webrtc: Support non-trickle ICE candidates in the SDP\n- webrtc: Unmap all non-binary buffers received via the datachannel\n- meson: build with neon 0.31\n- Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch\n\n- h264parser: guard against ref_pic_markings overflow\n  (bsc#1181255 CVE-2021-3185)\n\n- Disable the kate/libtiger plugin.  Kate streams for karaoke are not\n  used anymore, and the source tarball for libtiger is no longer\n  available upstream. (jsc#SLE-13843)\n\ngstreamer-plugins-ugly was updated to version 1.16.3 (bsc#1181255):\n\n+ x264enc: corrected em_data value in CEA-708 CC SEI message\n\ngstreamer-plugins-base was updated to version 1.16.3 (bsc#1181255):\n\n- audioaggregator: Check all downstream allowed caps structures if they support the upstream rate\n- audioaggregator: Fix negotiation with downstream if there is no peer yet\n- audioencoder: fix segment event leak\n- discoverer: Fix caps handling in `pad-added` signal handler\n- discoverer: Start discovering next URI from right thread\n- fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things\n- gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)\n- gl/display/egl: ensure debug category is initialized\n- gstglwindow_x11: fix resize\n- pbutils: Add latest H.264 level values\n- rtpbuffer: fix header extension length validation\n- video: Fix NV12_64Z32 number of component\n- video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5\n- video: fix top/bottom field flags\n- videodecoder: don't copy interlace-mode from reference state\n- appsrc/appsink: Make setting/replacing callbacks thread-safe\n- compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU\n- decodebin3: only force streams-selected seqnum after a select-streams\n- glupload: Fix fallback from direct dmabuf to dmabuf upload method\n- glvideomixer: perform `_get_highest_precision()` on the GL thread\n- libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings\n- oggstream: Workaround for broken PAR in VP8 BOS\n- subparse: accept WebVTT timestamps without an hour component\n- playbin: Handle error message with redirection indication\n- textrender: Fix AYUV output.\n- typefind: Consider MPEG-PS PSM to be a PES type\n- uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time\n- videoaggregator: Don't configure NULL chroma-site/colorimetry\n- videorate/videoscale/audioresample: Ensure that the caps returned from...\n- build: Replace bashisms in configure for Wayland and GLES3\n","status":"published","published":"2021-06-01T08:16:31Z","modified":"2026-02-04T02:35:33.192277Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1873-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2021-3185: Fixed buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking (bsc#1181255).\n","status":"published","published":"2021-06-07T06:18:16Z","modified":"2026-02-04T03:40:22.70227Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1875-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2021-3185: Fixed buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking (bsc#1181255).\n","status":"published","published":"2021-06-07T12:00:34Z","modified":"2026-02-04T03:23:03.492222Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1904-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2021-3185: h264parser: guard against ref_pic_markings overflow (bsc#1181255 \n","status":"published","published":"2021-06-08T17:32:11Z","modified":"2026-02-04T02:43:20.4644Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1944-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- Update to version 1.16.3:\n - CVE-2021-3185: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking() (bsc#1181255)\n - amcvideodec: fix sync meta copying not taking a reference\n - audiobuffersplit: Perform discont tracking on running time\n - audiobuffersplit: Specify in the template caps that only interleaved audio is supported\n - audiobuffersplit: Unset DISCONT flag if not discontinuous\n - autoconvert: Fix lock-less exchange or free condition\n - autoconvert: fix compiler warnings with g_atomic on recent GLib versions\n - avfvideosrc: element requests camera permissions even with capture-screen property is true\n - codecparsers: h264parser: guard against ref_pic_markings overflow\n - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated\n - dtls/connection: fix EOF handling with openssl 1.1.1e\n - fdkaacdec: add support for mpegversion=2\n - hls: Check nettle version to ensure AES128 support\n - ipcpipeline: Rework compiler checks\n - interlace: Increment phase_index before checking if we're at the end of the phase\n - h264parser: Do not allocate too large size of memory for registered user data SEI\n - ladspa: fix unbounded integer properties\n - modplug: avoid division by zero\n - msdkdec: Fix GstMsdkContext leak\n - msdkenc: fix leaks on windows\n - musepackdec: Don't fail all queries if no sample rate is known yet\n - openslessink: Allow openslessink to handle 48kHz streams.\n - opencv: allow compilation against 4.2.x\n - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc\n - vulkan: Drop use of VK_RESULT_BEGIN_RANGE\n - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset\n - wasapi: Fix possible deadlock while downwards state change\n - waylandsink: Clear window when pipeline is stopped\n - webrtc: Support non-trickle ICE candidates in the SDP\n - webrtc: Unmap all non-binary buffers received via the datachannel\n","status":"published","published":"2021-06-10T08:52:07Z","modified":"2026-02-04T04:10:31.11709Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}