This bug was fixed in the package gst-plugins-bad1.0 - 1.16.3-0ubuntu1.1
---------------
gst-plugins-bad1.0 (1.16.3-0ubuntu1.1) focal-security; urgency=medium
[ Luís Infante da Câmara ]
* SECURITY UPDATE: Heap buffer overflow in dvdspu (LP: #2035585)
- debian/patches/CVE-2023-37329-1.patch: Make sure enough data is
allocated for the available data.
- debian/patches/CVE-2023-37329-2.patch: Avoid integer overflow when
checking if enough data is available.
- CVE-2023-37329
[ Marc Deslauriers ]
* SECURITY UPDATE: integer overflow in MXF file handling
- debian/patches/CVE-2023-40474.patch: fix integer overflow causing out
of bounds writes when handling invalid uncompressed video in
gst/mxf/mxfup.c.
- CVE-2023-40474
* SECURITY UPDATE: integer overflow in MXF file handling
- debian/patches/CVE-2023-40475.patch: check number of channels for
AES3 audio in gst/mxf/mxfd10.c.
- CVE-2023-40475
* SECURITY UPDATE: integer overflow in H.265 video parser
- debian/patches/CVE-2023-40476.patch: fix possible overflow using
max_sub_layers_minus1 in gst-libs/gst/codecparsers/gsth265parser.c.
- CVE-2023-40476
* SECURITY UPDATE: MXF demuxer use-after-free
- debian/patches/CVE-2023-44446.patch: store GstMXFDemuxEssenceTrack in
their own fixed allocation in gst/mxf/mxfdemux.*.
- CVE-2023-44446
-- Marc Deslauriers <marc.deslauri...@ubuntu.com> Tue, 28 Nov 2023
13:33:46 -0500
** Changed in: gst-plugins-bad1.0 (Ubuntu)
Status: Confirmed => Fix Released
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-40474
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-40475
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-40476
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-44446
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to gst-plugins-bad1.0 in
Ubuntu.
https://bugs.launchpad.net/bugs/2035585
Title:
Versions in Ubuntu 20.04, 22.04 and 23.04 are vulnerable to
CVE-2023-37329
Status in gst-plugins-bad1.0 package in Ubuntu:
Fix Released
Bug description:
The versions in Ubuntu 20.04, 22.04 and 23.04 are vulnerable to
CVE-2023-37329.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gst-plugins-bad1.0/+bug/2035585/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
