[CLSA-2026:1788438390] gstreamer1-plugins-bad-free: Fix of CVE-2026-19387
Type:
security
Severity:
Important
Release date:
2026-09-03 12:26:41 UTC
Description:
- CVE-2026-19387: fix out-of-bounds write in the IMA ADPCM decoder by correcting the input size check to account for the channel count, and fail negotiation when block_align is not provided
CVEs fixed:
Updated packages:
  • gstreamer1-plugins-bad-free-1.18.4-6.el9_2.tuxcare.els8.i686.rpm
    sha:6487d7e98804491cafff910b6b32fba3d9448fa6c1ac75cc57fc760f2dcac305
  • gstreamer1-plugins-bad-free-1.18.4-6.el9_2.tuxcare.els8.x86_64.rpm
    sha:92f5461054508bd10e3673896d0227a1419be590bab8d9cb7806ff458c8358f3
  • gstreamer1-plugins-bad-free-devel-1.18.4-6.el9_2.tuxcare.els8.i686.rpm
    sha:1d268cb1b64f5aced8c596fa987a2781d08529df2872ad0e8067c7b059c98b26
  • gstreamer1-plugins-bad-free-devel-1.18.4-6.el9_2.tuxcare.els8.x86_64.rpm
    sha:ef0ace1c3a254fc427748cb207a969c7eed84781fdd4e3ef45e8cc7854e0ec5a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.