{"cves":[{"id":"CVE-2024-47541","published":"2024-12-12T00:00:00","updated_at":"2026-08-17T18:45:57.463391+00:00","description":"\nGStreamer is a library for constructing graphs of media-handling\ncomponents. An OOB-write vulnerability has been identified in the\ngst_ssa_parse_remove_override_codes function of the gstssaparse.c file.\nThis function is responsible for parsing and removing SSA (SubStation\nAlpha) style override codes, which are enclosed in curly brackets ({}). The\nissue arises when a closing curly bracket \"}\" appears before an opening\ncurly bracket \"{\" in the input string. In this case, memmove() incorrectly\nduplicates a substring. With each successive loop iteration, the size\npassed to memmove() becomes progressively larger (strlen(end+1)), leading\nto a write beyond the allocated memory bounds. This vulnerability is fixed\nin 1.24.10.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.9,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47541","https://gstreamer.freedesktop.org/security/sa-2024-0023.html","https://securitylab.github.com/advisories/GHSL-2024-228_GStreamer/","https://ubuntu.com/security/notices/USN-7175-1","https://ubuntu.com/security/notices/USN-7807-1"],"bugs":["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3870"],"patches":{"gst-plugins-base0.10":[],"gst-plugins-base1.0":["upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036.patch","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/15bb318416e1bf6b6b557006a37d1da86c3a76a8","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/403b10eba06679319aa2e35d310236234782102f","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7108073b5be73eb2482eb8494745962b8c0571f1","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b66cf81e99ab9f400b6aea79a4b597c5ddac324d"]},"tags":{},"packages":[{"name":"gst-plugins-base0.10","source":"https://ubuntu.com/security/cve?package=gst-plugins-base0.10","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-base0.10","debian":"https://tracker.debian.org/pkg/gst-plugins-base0.10","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"gst-plugins-base1.0","source":"https://ubuntu.com/security/cve?package=gst-plugins-base1.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-base1.0","debian":"https://tracker.debian.org/pkg/gst-plugins-base1.0","statuses":[{"release_codename":"upstream","status":"released","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.16.3-0ubuntu1.4","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.20.1-1ubuntu0.4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.24.2-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"1.24.8-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.14.5-0ubuntu1~18.04.3+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"1.8.3-1ubuntu0.3+esm2","component":null,"pocket":"esm-infra"},{"release_codename":"questing","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7175-1","USN-7807-1"],"notices":[{"id":"USN-7175-1","title":"GStreamer Base Plugins vulnerabilities","summary":"GStreamer Base Plugins could be made to crash or run programs as your login\nif it opened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:24:08.708467","description":"Antonio Morales discovered that GStreamer Base Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Base Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"gst-plugins-base1.0","version":"1.16.3-0ubuntu1.4","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"}],"jammy":[{"name":"gst-plugins-base1.0","version":"1.20.1-1ubuntu0.4","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"}],"noble":[{"name":"gst-plugins-base1.0","version":"1.24.2-1ubuntu0.2","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"}],"oracular":[{"name":"gst-plugins-base1.0","version":"1.24.8-1ubuntu0.1","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-47542","CVE-2024-47600","CVE-2024-47541","CVE-2024-47607","CVE-2024-47615","CVE-2024-47835","CVE-2024-47538"]},{"id":"USN-7807-1","title":"GStreamer Base Plugins vulnerabilities","summary":"Several security issues were fixed in GStreamer Base Plugins.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-07T03:19:35.573363","description":"Michael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain integer operations. An attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)\n\nMichael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2023-37328)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2024-47538)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,\nCVE-2024-47835)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-47600)","is_hidden":false,"release_packages":{"bionic":[{"name":"gst-plugins-base1.0","version":"1.14.5-0ubuntu1~18.04.3+esm1","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-alsa","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-gl","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-x","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-gl1.0-0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"gst-plugins-base1.0","version":"1.8.3-1ubuntu0.3+esm2","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-alsa","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-x","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2024-47607","CVE-2024-47835","CVE-2023-37328","CVE-2024-47541","CVE-2024-47615","CVE-2024-47542","CVE-2023-37327","CVE-2024-47600","CVE-2024-4453","CVE-2024-47538"]}]},{"id":"CVE-2024-47540","published":"2024-12-12T00:00:00","updated_at":"2026-08-17T18:46:29.939023+00:00","description":"\nGStreamer is a library for constructing graphs of media-handling\ncomponents. An uninitialized stack variable vulnerability has been\nidentified in the gst_matroska_demux_add_wvpk_header function within\nmatroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an\nuninitialized map variable. Then, in the gst_memory_unmap function, the\nprogram will attempt to unmap the buffer using the uninitialized map\nvariable, causing a function pointer hijack, as it will jump to\nmem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This\nvulnerability could allow an attacker to hijack the execution flow,\npotentially leading to code execution. This vulnerability is fixed in\n1.24.10.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47540","https://gstreamer.freedesktop.org/security/sa-2024-0017.html","https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/","https://ubuntu.com/security/notices/USN-7176-1"],"bugs":["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3863"],"patches":{"gst-plugins-good0.10":[],"gst-plugins-good1.0":["upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a16851ebf34a9f9be4285b2c0d75fe7844354efe","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/816a970a042c96669da25b7a046f0ab8311a78d9","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/eec4043430d30956ad4aea02a7b67a5758d99f11","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/2dcb071d4995032ed9242bb863189939b211f5cc","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e5ffa9c9778454457665c1ee1c5bcc17ed3537ac","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/09803e225de515c8881fd13ed464c23771a4d1a6","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/2c9abe111bd9122967784ef2b55c9017dc2682b8"]},"tags":{},"packages":[{"name":"gst-plugins-good0.10","source":"https://ubuntu.com/security/cve?package=gst-plugins-good0.10","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good0.10","debian":"https://tracker.debian.org/pkg/gst-plugins-good0.10","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"gst-plugins-good1.0","source":"https://ubuntu.com/security/cve?package=gst-plugins-good1.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good1.0","debian":"https://tracker.debian.org/pkg/gst-plugins-good1.0","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.16.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.20.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.24.2-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"1.24.8-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7176-1"],"notices":[{"id":"USN-7176-1","title":"GStreamer Good Plugins vulnerabilities","summary":"GStreamer Good Plugins could be made to crash or run programs as your login\nif it opened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:29:45.910993","description":"Antonio Morales discovered that GStreamer Good Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Good Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"gst-plugins-good1.0","version":"1.16.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good-doc","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"}],"jammy":[{"name":"gst-plugins-good1.0","version":"1.20.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"}],"noble":[{"name":"gst-plugins-good1.0","version":"1.24.2-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"}],"oracular":[{"name":"gst-plugins-good1.0","version":"1.24.8-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-47537","CVE-2024-47776","CVE-2024-47834","CVE-2024-47545","CVE-2024-47596","CVE-2024-47546","CVE-2024-47603","CVE-2024-47774","CVE-2024-47778","CVE-2024-47540","CVE-2024-47775","CVE-2024-47601","CVE-2024-47543","CVE-2024-47777","CVE-2024-47602","CVE-2024-47544","CVE-2024-47597","CVE-2024-47598","CVE-2024-47599","CVE-2024-47613","CVE-2024-47606","CVE-2024-47539"]}]},{"id":"CVE-2024-47539","published":"2024-12-12T00:00:00","updated_at":"2026-08-17T18:44:39.134527+00:00","description":"\nGStreamer is a library for constructing graphs of media-handling\ncomponents. An out-of-bounds write vulnerability was identified in the\nconvert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises\ndue to a discrepancy between the size of memory allocated to the storage\narray and the loop condition i * 2 < ccpair_size. Specifically, when\nccpair_size is even, the allocated size in storage does not match the\nloop's expected bounds, resulting in an out-of-bounds write. This bug\nallows for the overwriting of up to 3 bytes beyond the allocated bounds of\nthe storage array. This vulnerability is fixed in 1.24.10.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"same commits as listed in CVE-2024-47537"}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47539","https://gstreamer.freedesktop.org/security/sa-2024-0007.html","https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/","https://ubuntu.com/security/notices/USN-7176-1"],"bugs":["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3839"],"patches":{"gst-plugins-good0.10":[],"gst-plugins-good1.0":["upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c3a2af94c652513ac1b1858295688ac88c5cc737","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/812f175c580a2e702581859fd481c8f51d633508","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/eb7f9331c2294bc28a549b79c9f931c3e6c6bc44","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1def2965d8da8cc74ab0036d7f8d59e81e676cad","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/314945426c7105ad90f44a188037bc43bb3b0300","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8ef08a7a41da987aa630082df355ea651aa09132","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/fe9d5d37234aca04fef7248184177168905a7a69","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8e884e4e31649a9fc19095d6501a1143b074aba8","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7f8f280555201f51898727919831259e68271868","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83056792a8bd179d7e4ba4b3d234ab75205e47d2","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f31dbbc1bcc00096ab863ee6aaecad493c71c333","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8603e78a07a307139fd45ee11e7623de01494bf3"]},"tags":{},"packages":[{"name":"gst-plugins-good0.10","source":"https://ubuntu.com/security/cve?package=gst-plugins-good0.10","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good0.10","debian":"https://tracker.debian.org/pkg/gst-plugins-good0.10","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"gst-plugins-good1.0","source":"https://ubuntu.com/security/cve?package=gst-plugins-good1.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good1.0","debian":"https://tracker.debian.org/pkg/gst-plugins-good1.0","statuses":[{"release_codename":"resolute","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.16.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.20.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.24.2-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"1.24.8-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7176-1"],"notices":[{"id":"USN-7176-1","title":"GStreamer Good Plugins vulnerabilities","summary":"GStreamer Good Plugins could be made to crash or run programs as your login\nif it opened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:29:45.910993","description":"Antonio Morales discovered that GStreamer Good Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Good Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"gst-plugins-good1.0","version":"1.16.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good-doc","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"}],"jammy":[{"name":"gst-plugins-good1.0","version":"1.20.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"}],"noble":[{"name":"gst-plugins-good1.0","version":"1.24.2-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"}],"oracular":[{"name":"gst-plugins-good1.0","version":"1.24.8-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-47537","CVE-2024-47776","CVE-2024-47834","CVE-2024-47545","CVE-2024-47596","CVE-2024-47546","CVE-2024-47603","CVE-2024-47774","CVE-2024-47778","CVE-2024-47540","CVE-2024-47775","CVE-2024-47601","CVE-2024-47543","CVE-2024-47777","CVE-2024-47602","CVE-2024-47544","CVE-2024-47597","CVE-2024-47598","CVE-2024-47599","CVE-2024-47613","CVE-2024-47606","CVE-2024-47539"]}]},{"id":"CVE-2024-47538","published":"2024-12-12T00:00:00","updated_at":"2026-08-17T18:43:20.483333+00:00","description":"\nGStreamer is a library for constructing graphs of media-handling\ncomponents. A stack-buffer overflow has been detected in the\n`vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The\nposition array is a stack-allocated buffer of size 64. If vd->vi.channels\nexceeds 64, the for loop will write beyond the boundaries of the position\narray. The value written will always be `GST_AUDIO_CHANNEL_POSITION_NONE`.\nThis vulnerability allows someone to overwrite the EIP address allocated in\nthe stack. Additionally, this bug can overwrite the `GstAudioInfo` info\nstructure. This vulnerability is fixed in 1.24.10.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47538","https://gstreamer.freedesktop.org/security/sa-2024-0022.html","https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/","https://ubuntu.com/security/notices/USN-7175-1","https://ubuntu.com/security/notices/USN-7807-1"],"bugs":["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3869"],"patches":{"gst-plugins-base0.10":[],"gst-plugins-base1.0":["upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5093691ef2ef5c7a6e03a20bce39db143b9cdc43","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7eb26b198beffecdba4dbb64299f9cb09a9181d6"]},"tags":{},"packages":[{"name":"gst-plugins-base0.10","source":"https://ubuntu.com/security/cve?package=gst-plugins-base0.10","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-base0.10","debian":"https://tracker.debian.org/pkg/gst-plugins-base0.10","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"gst-plugins-base1.0","source":"https://ubuntu.com/security/cve?package=gst-plugins-base1.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-base1.0","debian":"https://tracker.debian.org/pkg/gst-plugins-base1.0","statuses":[{"release_codename":"focal","status":"released","description":"1.16.3-0ubuntu1.4","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.20.1-1ubuntu0.4","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.24.2-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"1.24.8-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.14.5-0ubuntu1~18.04.3+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"1.8.3-1ubuntu0.3+esm2","component":null,"pocket":"esm-infra"},{"release_codename":"questing","status":"not-affected","description":"1.24.10-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7175-1","USN-7807-1"],"notices":[{"id":"USN-7175-1","title":"GStreamer Base Plugins vulnerabilities","summary":"GStreamer Base Plugins could be made to crash or run programs as your login\nif it opened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:24:08.708467","description":"Antonio Morales discovered that GStreamer Base Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Base Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"gst-plugins-base1.0","version":"1.16.3-0ubuntu1.4","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.16.3-0ubuntu1.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.4","pocket":"security"}],"jammy":[{"name":"gst-plugins-base1.0","version":"1.20.1-1ubuntu0.4","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.20.1-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.4","pocket":"security"}],"noble":[{"name":"gst-plugins-base1.0","version":"1.24.2-1ubuntu0.2","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.24.2-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.2","pocket":"security"}],"oracular":[{"name":"gst-plugins-base1.0","version":"1.24.8-1ubuntu0.1","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-alsa","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-gl","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-plugins-base","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"gstreamer1.0-x","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-gl1.0-0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.24.8-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.8-1ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-47542","CVE-2024-47600","CVE-2024-47541","CVE-2024-47607","CVE-2024-47615","CVE-2024-47835","CVE-2024-47538"]},{"id":"USN-7807-1","title":"GStreamer Base Plugins vulnerabilities","summary":"Several security issues were fixed in GStreamer Base Plugins.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-07T03:19:35.573363","description":"Michael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain integer operations. An attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2023-37327, CVE-2024-4453)\n\nMichael Randrianantenaina discovered that GStreamer Base Plugins did not\ncorrectly handle certain memory operations. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2023-37328)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2024-47538)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. (CVE-2024-47541, CVE-2024-47615)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle certain memory operations. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-47542, CVE-2024-47607,\nCVE-2024-47835)\n\nAntonio Morales discovered that GStreamer Base Plugins did not correctly\nhandle parsing certain inputs, which could lead to an out-of-bounds access\nvulnerability. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-47600)","is_hidden":false,"release_packages":{"bionic":[{"name":"gst-plugins-base1.0","version":"1.14.5-0ubuntu1~18.04.3+esm1","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-alsa","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-gl","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-x","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-gl1.0-0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.14.5-0ubuntu1~18.04.3+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"gst-plugins-base1.0","version":"1.8.3-1ubuntu0.3+esm2","description":"GStreamer plugins","is_source":true},{"name":"gir1.2-gst-plugins-base-1.0","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-alsa","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-apps","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-plugins-base-doc","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"gstreamer1.0-x","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-0","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"},{"name":"libgstreamer-plugins-base1.0-dev","version":"1.8.3-1ubuntu0.3+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-base1.0","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2024-47607","CVE-2024-47835","CVE-2023-37328","CVE-2024-47541","CVE-2024-47615","CVE-2024-47542","CVE-2023-37327","CVE-2024-47600","CVE-2024-4453","CVE-2024-47538"]}]},{"id":"CVE-2024-47537","published":"2024-12-12T00:00:00","updated_at":"2026-08-17T18:46:58.483561+00:00","description":"\nGStreamer is a library for constructing graphs of media-handling\ncomponents. The program attempts to reallocate the memory pointed to by\nstream->samples to accommodate stream->n_samples + samples_count elements\nof type QtDemuxSample. The problem is that samples_count is read from the\ninput file. And if this value is big enough, this can lead to an integer\noverflow during the addition. As a consequence, g_try_renew might allocate\nmemory for a significantly smaller number of elements than intended.\nFollowing this, the program iterates through samples_count elements and\nattempts to write samples_count number of elements, potentially exceeding\nthe actual allocated memory size and causing an OOB-write. This\nvulnerability is fixed in 1.24.10.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47537","https://gstreamer.freedesktop.org/security/sa-2024-0005.html","https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/","https://ubuntu.com/security/notices/USN-7176-1"],"bugs":["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3839"],"patches":{"gst-plugins-good0.10":[],"gst-plugins-good1.0":["upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c3a2af94c652513ac1b1858295688ac88c5cc737","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/812f175c580a2e702581859fd481c8f51d633508","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/eb7f9331c2294bc28a549b79c9f931c3e6c6bc44","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1def2965d8da8cc74ab0036d7f8d59e81e676cad","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/314945426c7105ad90f44a188037bc43bb3b0300","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8ef08a7a41da987aa630082df355ea651aa09132","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/fe9d5d37234aca04fef7248184177168905a7a69","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8e884e4e31649a9fc19095d6501a1143b074aba8","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7f8f280555201f51898727919831259e68271868","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83056792a8bd179d7e4ba4b3d234ab75205e47d2","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f31dbbc1bcc00096ab863ee6aaecad493c71c333","upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8603e78a07a307139fd45ee11e7623de01494bf3"]},"tags":{},"packages":[{"name":"gst-plugins-good0.10","source":"https://ubuntu.com/security/cve?package=gst-plugins-good0.10","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good0.10","debian":"https://tracker.debian.org/pkg/gst-plugins-good0.10","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"gst-plugins-good1.0","source":"https://ubuntu.com/security/cve?package=gst-plugins-good1.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gst-plugins-good1.0","debian":"https://tracker.debian.org/pkg/gst-plugins-good1.0","statuses":[{"release_codename":"resolute","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.24.10-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.16.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.20.3-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.24.2-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"1.24.8-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.24.10-1ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7176-1"],"notices":[{"id":"USN-7176-1","title":"GStreamer Good Plugins vulnerabilities","summary":"GStreamer Good Plugins could be made to crash or run programs as your login\nif it opened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:29:45.910993","description":"Antonio Morales discovered that GStreamer Good Plugins incorrectly handled\ncertain malformed media files. An attacker could use these issues to cause\nGStreamer Good Plugins to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"gst-plugins-good1.0","version":"1.16.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good-doc","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.16.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.16.3-0ubuntu1.3","pocket":"security"}],"jammy":[{"name":"gst-plugins-good1.0","version":"1.20.3-0ubuntu1.3","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.20.3-0ubuntu1.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.20.3-0ubuntu1.3","pocket":"security"}],"noble":[{"name":"gst-plugins-good1.0","version":"1.24.2-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.2-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.2-1ubuntu1.1","pocket":"security"}],"oracular":[{"name":"gst-plugins-good1.0","version":"1.24.8-1ubuntu1.1","description":"GStreamer plugins","is_source":true},{"name":"gstreamer1.0-gtk3","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-plugins-good","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-pulseaudio","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt5","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"gstreamer1.0-qt6","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-0","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"},{"name":"libgstreamer-plugins-good1.0-dev","version":"1.24.8-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0","version_link":"https://launchpad.net/ubuntu/+source/gst-plugins-good1.0/1.24.8-1ubuntu1.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-47537","CVE-2024-47776","CVE-2024-47834","CVE-2024-47545","CVE-2024-47596","CVE-2024-47546","CVE-2024-47603","CVE-2024-47774","CVE-2024-47778","CVE-2024-47540","CVE-2024-47775","CVE-2024-47601","CVE-2024-47543","CVE-2024-47777","CVE-2024-47602","CVE-2024-47544","CVE-2024-47597","CVE-2024-47598","CVE-2024-47599","CVE-2024-47613","CVE-2024-47606","CVE-2024-47539"]}]},{"id":"CVE-2024-45337","published":"2024-12-12T00:00:00","updated_at":"2025-11-03T16:21:47.184148+00:00","description":"\nApplications and libraries which misuse connection.serverAuthenticate (via\ncallback field ServerConfig.PublicKeyCallback) may be susceptible to an\nauthorization bypass. The documentation for ServerConfig.PublicKeyCallback\nsays that \"A call to this function does not guarantee that the key offered\nis in fact used to authenticate.\" Specifically, the SSH protocol allows\nclients to inquire about whether a public key is acceptable before proving\ncontrol of the corresponding private key. PublicKeyCallback may be called\nwith multiple keys, and the order in which the keys were provided cannot be\nused to infer which key the client successfully authenticated with, if any.\nSome applications, which store the key(s) passed to PublicKeyCallback (or\nderived information) and make security relevant determinations based on it\nonce the connection is established, may make incorrect assumptions. For\nexample, an attacker may send public keys A and B, and then authenticate\nwith A. PublicKeyCallback would be called only twice, first with A and then\nwith B. A vulnerable application may then make authorization decisions\nbased on key B for which the attacker does not actually control the private\nkey. Since this API is widely misused, as a partial mitigation\ngolang.org/x/cry...@v0.31.0 enforces the property that, when successfully\nauthenticating via public key, the last key passed to\nServerConfig.PublicKeyCallback will be the key used to authenticate the\nconnection. PublicKeyCallback will now be called multiple times with the\nsame key, if necessary. Note that the client may still not control the last\nkey passed to PublicKeyCallback if the connection is then authenticated\nwith a different method, such as PasswordCallback,\nKeyboardInteractiveCallback, or NoClientAuth. Users should be using the\nExtensions field of the Permissions return value from the various\nauthentication callbacks to record data associated with the authentication\nattempt instead of referencing external state. Once the connection is\nestablished the state corresponding to the successful authentication\nattempt can be retrieved via the ServerConn.Permissions field. Note that\nsome third-party libraries misuse the Permissions type by sharing it across\nauthentication attempts; users of third-party libraries should refer to the\nrelevant projects for guidance.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"snapd contains an embedded copy of golang-go.crypto\nlxd in 18.04 LTS and earlier contains an embedded copy of\ngolang-go.crypto"},{"author":"hlibk","note":"google-guest-agent contains an embedded copy of golang-go.crypto"}],"codename":null,"priority":"medium","cvss3":9.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-45337","https://go-review.googlesource.com/c/crypto/+/635315/","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://go.dev/cl/635315","https://pkg.go.dev/vuln/GO-2024-3321","https://ubuntu.com/security/notices/USN-7839-1","https://ubuntu.com/security/notices/USN-7839-2"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089754","https://github.com/golang/go/issues/70779"],"patches":{"golang-go.crypto":["upstream: https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"],"snapd":[],"lxd":[],"google-guest-agent":[]},"tags":{},"packages":[{"name":"golang-go.crypto","source":"https://ubuntu.com/security/cve?package=golang-go.crypto","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=golang-go.crypto","debian":"https://tracker.debian.org/pkg/golang-go.crypto","statuses":[{"release_codename":"resolute","status":"not-affected","description":"1:0.47.0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.31.0,1:0.42.0-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"released","description":"1:0.0~git20211202.5770296-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"noble","status":"released","description":"1:0.19.0-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"xenial","status":"released","description":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"}]},{"name":"google-guest-agent","source":"https://ubuntu.com/security/cve?package=google-guest-agent","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=google-guest-agent","debian":"https://tracker.debian.org/pkg/google-guest-agent","statuses":[{"release_codename":"resolute","status":"not-affected","description":"20250506.01-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"20250506.01-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"20250506.01","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"20241011.01-0ubuntu1~18.04.0+esm1","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"20250116.00-0ubuntu1~20.04.0+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"jammy","status":"released","description":"20250116.00-0ubuntu1~22.04.1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"20250116.00-0ubuntu1~24.04.2","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"20250116.00-0ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"20240716.00-0ubuntu1~16.04.0+esm1","component":null,"pocket":"esm-apps"}]},{"name":"lxd","source":"https://ubuntu.com/security/cve?package=lxd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=lxd","debian":"https://tracker.debian.org/pkg/lxd","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code-not-present","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"snapd","source":"https://ubuntu.com/security/cve?package=snapd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=snapd","debian":"https://tracker.debian.org/pkg/snapd","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":["USN-7839-1","USN-7839-2"],"notices":[{"id":"USN-7839-1","title":"Go Cryptography vulnerability","summary":"Go Cryptography could allow unintended access to network services.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-23T18:49:40.634066","description":"Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier\ndiscovered that Go Cryptography incorrectly handled public keys during SSH\noperations. An attacker could possibly use this issue to bypass\nauthorization mechanisms.","is_hidden":false,"release_packages":{"bionic":[{"name":"golang-go.crypto","version":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","description":"Supplementary Go cryptography libraries","is_source":true},{"name":"golang-go.crypto-dev","version":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-apps"},{"name":"golang-golang-x-crypto-dev","version":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"golang-go.crypto","version":"1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1","description":"Supplementary Go cryptography libraries","is_source":true},{"name":"golang-golang-x-crypto-dev","version":"1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"golang-go.crypto","version":"1:0.0~git20211202.5770296-1ubuntu0.1~esm1","description":"Supplementary Go cryptography libraries","is_source":true},{"name":"golang-golang-x-crypto-dev","version":"1:0.0~git20211202.5770296-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-apps"}],"noble":[{"name":"golang-go.crypto","version":"1:0.19.0-1ubuntu0.1~esm1","description":"Supplementary Go cryptography libraries","is_source":true},{"name":"golang-golang-x-crypto-dev","version":"1:0.19.0-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-apps"}],"xenial":[{"name":"golang-go.crypto","version":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","description":"Supplementary Go cryptography libraries","is_source":true},{"name":"golang-go.crypto-dev","version":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-infra"},{"name":"golang-golang-x-crypto-dev","version":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/golang-go.crypto","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2024-45337"]},{"id":"USN-7839-2","title":"Google Guest Agent vulnerability","summary":"Google Guest Agent could allow unintended access to network services.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-11-03T10:18:02.213974","description":"USN-7839-1 fixed vulnerabilities in Go Cryptography. This update provides\nthe corresponding update in the Go Cryptography module included in Google\nGuest Agent.\n\nOriginal advisory details:\n\n Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier\n discovered that Go Cryptography incorrectly handled public keys during SSH\n operations. An attacker could possibly use this issue to bypass\n authorization mechanisms.","is_hidden":false,"release_packages":{"bionic":[{"name":"google-guest-agent","version":"20241011.01-0ubuntu1~18.04.0+esm1","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20241011.01-0ubuntu1~18.04.0+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~20.04.0+esm1","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~20.04.0+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":null,"pocket":"esm-infra"}],"jammy":[{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~22.04.1","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":"https://launchpad.net/ubuntu/+source/google-guest-agent/20250116.00-0ubuntu1~22.04.1","pocket":"security"}],"noble":[{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~24.04.2","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20250116.00-0ubuntu1~24.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":"https://launchpad.net/ubuntu/+source/google-guest-agent/20250116.00-0ubuntu1~24.04.2","pocket":"security"}],"plucky":[{"name":"google-guest-agent","version":"20250116.00-0ubuntu2.1","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20250116.00-0ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":"https://launchpad.net/ubuntu/+source/google-guest-agent/20250116.00-0ubuntu2.1","pocket":"security"}],"xenial":[{"name":"google-guest-agent","version":"20240716.00-0ubuntu1~16.04.0+esm1","description":"Google Compute Engine Guest Agent","is_source":true},{"name":"google-guest-agent","version":"20240716.00-0ubuntu1~16.04.0+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/google-guest-agent","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2024-45337"]}]},{"id":"CVE-2024-4109","published":"2024-12-12T00:00:00","updated_at":"2025-07-11T08:08:44.262386+00:00","description":"\nRejected reason: Red Hat Product Security has determined that this CVE is\nnot a security vulnerability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-4109","https://access.redhat.com/security/cve/CVE-2024-4109","https://bugzilla.redhat.com/show_bug.cgi?id=2272325"],"bugs":[""],"patches":{"undertow":[]},"tags":{},"packages":[{"name":"undertow","source":"https://ubuntu.com/security/cve?package=undertow","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=undertow","debian":"https://tracker.debian.org/pkg/undertow","statuses":[{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-12570","published":"2024-12-12T00:00:00","updated_at":"2025-08-26T00:21:08.762437+00:00","description":"\nAn issue has been discovered in GitLab CE/EE affecting all versions\nstarting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from\n17.6 prior to 17.6.2. It may have been possible for an attacker with a\nvictim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the\nvictim.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"GitLab isn't maintainable as a distro package, and was removed\nfrom Ubuntu because of this. We will not be fixing security\nissues in the gitlab package in Xenial."}],"codename":null,"priority":"medium","cvss3":6.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW","baseScore":6.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-12570","https://gitlab.com/gitlab-org/gitlab/-/issues/494694","https://hackerone.com/reports/2724948"],"bugs":[""],"patches":{"gitlab":[]},"tags":{},"packages":[{"name":"gitlab","source":"https://ubuntu.com/security/cve?package=gitlab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gitlab","debian":"https://tracker.debian.org/pkg/gitlab","statuses":[{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-12292","published":"2024-12-12T00:00:00","updated_at":"2025-08-26T00:21:03.887727+00:00","description":"\nAn issue was discovered in GitLab CE/EE affecting all versions starting\nfrom 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting\nfrom 17.6 prior to 17.6.2, where sensitive information passed in GraphQL\nmutations may have been retained in GraphQL logs.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"GitLab isn't maintainable as a distro package, and was removed\nfrom Ubuntu because of this. We will not be fixing security\nissues in the gitlab package in Xenial."}],"codename":null,"priority":"medium","cvss3":4.0,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-12292","https://gitlab.com/gitlab-org/gitlab/-/issues/475211"],"bugs":[""],"patches":{"gitlab":[]},"tags":{},"packages":[{"name":"gitlab","source":"https://ubuntu.com/security/cve?package=gitlab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gitlab","debian":"https://tracker.debian.org/pkg/gitlab","statuses":[{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-11274","published":"2024-12-12T00:00:00","updated_at":"2025-08-26T00:20:47.904314+00:00","description":"\nAn issue was discovered in GitLab CE/EE affecting all versions starting\nfrom 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting\nfrom 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response\ncould lead to session data exfiltration.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"GitLab isn't maintainable as a distro package, and was removed\nfrom Ubuntu because of this. We will not be fixing security\nissues in the gitlab package in Xenial."}],"codename":null,"priority":"medium","cvss3":8.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-11274","https://gitlab.com/gitlab-org/gitlab/-/issues/504707","https://hackerone.com/reports/2813673"],"bugs":[""],"patches":{"gitlab":[]},"tags":{},"packages":[{"name":"gitlab","source":"https://ubuntu.com/security/cve?package=gitlab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gitlab","debian":"https://tracker.debian.org/pkg/gitlab","statuses":[{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-10043","published":"2024-12-12T00:00:00","updated_at":"2025-08-26T00:20:37.277096+00:00","description":"\nAn issue has been discovered in GitLab EE affecting all versions starting\nfrom 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all\nversions starting from 17.6 before 17.6.2, that allows group users to view\nconfidential incident title through the Wiki History Diff feature,\npotentially leading to information disclosure.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"GitLab isn't maintainable as a distro package, and was removed\nfrom Ubuntu because of this. We will not be fixing security\nissues in the gitlab package in Xenial."}],"codename":null,"priority":"medium","cvss3":3.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-10043","https://gitlab.com/gitlab-org/gitlab/-/issues/499577","https://hackerone.com/reports/2774817"],"bugs":[""],"patches":{"gitlab":[]},"tags":{},"packages":[{"name":"gitlab","source":"https://ubuntu.com/security/cve?package=gitlab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gitlab","debian":"https://tracker.debian.org/pkg/gitlab","statuses":[{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-48912","published":"2024-12-11T17:15:00","updated_at":"2026-08-17T18:44:08.607822+00:00","description":"\nGLPI is a free asset and IT management software package. Starting in\nversion 10.0.0 and prior to version 10.0.17, an authenticated user can use\nan application endpoint to delete any user account. Version 10.0.17\ncontains a patch for this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":7.2,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-48912","https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f","https://github.com/glpi-project/glpi/releases/tag/10.0.17"],"bugs":[""],"patches":{"glpi":[]},"tags":{},"packages":[{"name":"glpi","source":"https://ubuntu.com/security/cve?package=glpi","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glpi","debian":"https://tracker.debian.org/pkg/glpi","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-47761","published":"2024-12-11T17:15:00","updated_at":"2026-08-17T18:42:45.857882+00:00","description":"\nGLPI is a free asset and IT management software package. Starting in\nversion 0.80 and prior to version 10.0.17, an administrator with access to\nthe sent notifications contents can take control of an account with higher\nprivileges. Version 10.0.17 contains a patch for this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.2,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47761","https://github.com/glpi-project/glpi/security/advisories/GHSA-x794-564w-vgxx","https://github.com/glpi-project/glpi/releases/tag/10.0.17"],"bugs":[""],"patches":{"glpi":[]},"tags":{},"packages":[{"name":"glpi","source":"https://ubuntu.com/security/cve?package=glpi","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glpi","debian":"https://tracker.debian.org/pkg/glpi","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-47760","published":"2024-12-11T17:15:00","updated_at":"2026-08-17T18:47:26.750440+00:00","description":"\nGLPI is a free asset and IT management software package. Starting in\nversion 9.1.0 and prior to version 10.0.17, a technician with an access to\nthe API can take control of an account with higher privileges. Version\n10.0.17 contains a patch for this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47760","https://github.com/glpi-project/glpi/security/advisories/GHSA-r3mx-fr5f-gwgp","https://github.com/glpi-project/glpi/releases/tag/10.0.17"],"bugs":[""],"patches":{"glpi":[]},"tags":{},"packages":[{"name":"glpi","source":"https://ubuntu.com/security/cve?package=glpi","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glpi","debian":"https://tracker.debian.org/pkg/glpi","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-47758","published":"2024-12-11T16:15:00","updated_at":"2026-08-17T18:37:24.268894+00:00","description":"\nGLPI is a free asset and IT management software package. Starting in\nversion 9.3.0 and prior to version 10.0.17, an authenticated user can use\nthe API to take control of any user that have the same or a lower level of\nprivileges. Version 10.0.17 contains a patch for this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":7.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-47758","https://github.com/glpi-project/glpi/security/advisories/GHSA-3r4x-6pmx-phwr","https://github.com/glpi-project/glpi/releases/tag/10.0.17"],"bugs":[""],"patches":{"glpi":[]},"tags":{},"packages":[{"name":"glpi","source":"https://ubuntu.com/security/cve?package=glpi","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glpi","debian":"https://tracker.debian.org/pkg/glpi","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-11053","published":"2024-12-11T00:00:00","updated_at":"2026-07-10T21:46:36.369887+00:00","description":"\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password\nor\nomits both login and password.","ubuntu_description":"","notes":[{"author":"","note":"Priority reason:\ncurl developers have rated this issue as low severity"}],"codename":null,"priority":"low","cvss3":3.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-11053","https://curl.se/docs/CVE-2024-11053.html","https://ubuntu.com/security/notices/USN-7162-1","https://ubuntu.com/security/notices/USN-8525-1"],"bugs":[""],"patches":{"curl":["upstream: https://github.com/curl/curl/commit/e9b9bbac22c26cf6731"]},"tags":{},"packages":[{"name":"curl","source":"https://ubuntu.com/security/cve?package=curl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=curl","debian":"https://tracker.debian.org/pkg/curl","statuses":[{"release_codename":"bionic","status":"released","description":"7.58.0-2ubuntu3.24+esm10","component":null,"pocket":"esm-infra"},{"release_codename":"trusty","status":"released","description":"7.35.0-1ubuntu2.20+esm21","component":null,"pocket":"esm-infra-legacy"},{"release_codename":"xenial","status":"released","description":"7.47.0-1ubuntu2.19+esm17","component":null,"pocket":"esm-infra-legacy"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"7.68.0-1ubuntu2.25","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"7.81.0-1ubuntu1.20","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"8.5.0-2ubuntu10.6","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"8.9.1-2ubuntu2.2","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"8.11.1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"8.11.1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"8.11.1-1ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-7162-1","USN-8525-1"],"notices":[{"id":"USN-7162-1","title":"curl vulnerability","summary":"curl could be made to expose sensitive information.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-16T12:24:41.800901","description":"Harry Sintonen discovered that curl incorrectly handled credentials from\n.netrc files when following HTTP redirects. In certain configurations, the\npassword for the first host could be leaked to the followed-to host,\ncontrary to expectations.\n","is_hidden":false,"release_packages":{"focal":[{"name":"curl","version":"7.68.0-1ubuntu2.25","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl3-nss","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl4","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl4-doc","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.68.0-1ubuntu2.25","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.25","pocket":"security"}],"jammy":[{"name":"curl","version":"7.81.0-1ubuntu1.20","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl3-nss","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl4","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl4-doc","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.81.0-1ubuntu1.20","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.20","pocket":"security"}],"noble":[{"name":"curl","version":"8.5.0-2ubuntu10.6","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"},{"name":"libcurl3t64-gnutls","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"},{"name":"libcurl4-doc","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"},{"name":"libcurl4t64","version":"8.5.0-2ubuntu10.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.6","pocket":"security"}],"oracular":[{"name":"curl","version":"8.9.1-2ubuntu2.2","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"},{"name":"libcurl3t64-gnutls","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"},{"name":"libcurl4-doc","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"},{"name":"libcurl4t64","version":"8.9.1-2ubuntu2.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.9.1-2ubuntu2.2","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2024-11053"]},{"id":"USN-8525-1","title":"curl vulnerabilities","summary":"Several security issues were fixed in curl.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2026-07-09T19:14:44.553058","description":"Harry Sintonen discovered that curl incorrectly handled credentials when\nfollowing HTTP redirects in conjunction with .netrc files. An attacker\ncould possibly use this issue to obtain sensitive information. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2024-11053)\n\nHiroki Kurosawa discovered that curl incorrectly handled OCSP stapling\nresponses. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS. (CVE-2024-8096)\n\nJoshua Rogers discovered that curl had a use-after-free vulnerability when\nresetting and cleaning up HTTP/2 stream handles. An attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code. This\nissue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.\n(CVE-2026-10536)\n\nQuac Tran and Ngoc Hieu discovered that curl incorrectly reused connections\nwhen switching authentication methods to the same host. An attacker could\npossibly use this issue to obtain sensitive information or perform\nunauthorized actions. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-5545)\n\nOsama Hamad discovered that curl incorrectly reused SMB connections when\nthe target share differed between transfers. An attacker could possibly use\nthis issue to obtain sensitive information. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773)\n\nMuhamad Arga Reksapati discovered that curl incorrectly forwarded Digest\nproxy authentication credentials to a different proxy host. An attacker\ncould possibly use this issue to obtain sensitive information. This issue\nonly affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168)\n\nIt was discovered that curl incorrectly skipped SSH host verification\noptions when using schemeless URLs with --proto-default. An attacker could\npossibly use this issue to perform machine-in-the-middle attacks. This\nissue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-12064)\n\nIt was discovered that curl did not enforce an upper bound on memory\nallocated for unacknowledged WebSocket PING frames. A remote attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 25.10. (CVE-2026-11586)\n\nIt was discovered that curl could stall indefinitely when a malicious\nHTTP/3 server sent a continuous stream of empty UDP datagrams. A remote\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 25.10. (CVE-2026-11352)\n\nIt was discovered that curl could incorrectly continue trusting a native\nplatform CA store after an application switched the handle to use custom CA\nmaterial. An attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 25.10. (CVE-2026-11564)","is_hidden":false,"release_packages":{"bionic":[{"name":"curl","version":"7.58.0-2ubuntu3.24+esm10","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.58.0-2ubuntu3.24+esm10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"focal":[{"name":"curl","version":"7.68.0-1ubuntu2.25+esm5","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.68.0-1ubuntu2.25+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"noble":[{"name":"curl","version":"8.5.0-2ubuntu10.11","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"},{"name":"libcurl3t64-gnutls","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"},{"name":"libcurl4-doc","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"},{"name":"libcurl4t64","version":"8.5.0-2ubuntu10.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11","pocket":"security"}],"questing":[{"name":"curl","version":"8.14.1-2ubuntu1.5","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"},{"name":"libcurl3t64-gnutls","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"},{"name":"libcurl4-doc","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"},{"name":"libcurl4t64","version":"8.14.1-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5","pocket":"security"}],"resolute":[{"name":"curl","version":"8.18.0-1ubuntu2.3","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"},{"name":"libcurl3t64-gnutls","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"},{"name":"libcurl4-doc","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"},{"name":"libcurl4-gnutls-dev","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"},{"name":"libcurl4t64","version":"8.18.0-1ubuntu2.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3","pocket":"security"}],"trusty":[{"name":"curl","version":"7.35.0-1ubuntu2.20+esm21","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3-gnutls","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3-nss","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-doc","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-gnutls-dev","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-nss-dev","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-openssl-dev","version":"7.35.0-1ubuntu2.20+esm21","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"}],"xenial":[{"name":"curl","version":"7.47.0-1ubuntu2.19+esm17","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3-gnutls","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl3-nss","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-doc","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-gnutls-dev","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-nss-dev","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libcurl4-openssl-dev","version":"7.47.0-1ubuntu2.19+esm17","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2026-11352","CVE-2026-7168","CVE-2024-8096","CVE-2026-5773","CVE-2026-10536","CVE-2026-5545","CVE-2026-11564","CVE-2026-11586","CVE-2024-11053","CVE-2026-12064"]}]},{"id":"CVE-2024-54133","published":"2024-12-10T23:15:00","updated_at":"2026-07-10T07:14:53.873032+00:00","description":"\nAction Pack is a framework for handling and responding to web requests.\nThere is a possible Cross Site Scripting (XSS) vulnerability  in the\n`content_security_policy` helper starting in version 5.2.0 of Action Pack\nand prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications\nwhich set Content-Security-Policy (CSP) headers dynamically from untrusted\nuser input may be vulnerable to carefully crafted inputs being able to\ninject new directives into the CSP. This could lead to a bypass of the CSP\nand its protection against XSS and other attacks. Versions 7.0.8.7,\n7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications\ncan avoid setting CSP headers dynamically from untrusted input, or can\nvalidate/sanitize that input.","ubuntu_description":"","notes":[{"author":"seth-arnold","note":"In Oneiric-Saucy, rails package is just for transition;\nThe rails package contains actual code from vivid onward"}],"codename":null,"priority":"medium","cvss3":null,"impact":{"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},"baseScore":2.3,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-54133","https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v","https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49 (v8.0.0.1)","https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a (v7.2.2.1)","https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542 (v7.1.5.1)","https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d (v7.0.8.7)"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089755"],"patches":{"rails":[]},"tags":{},"packages":[{"name":"rails","source":"https://ubuntu.com/security/cve?package=rails","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails","debian":"https://tracker.debian.org/pkg/rails","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-46657","published":"2024-12-10T17:15:00","updated_at":"2025-11-26T08:51:17.598892+00:00","description":"\nArtifex Software mupdf v1.24.9 was discovered to contain a segmentation\nfault via the component /tools/pdfextract.c. This vulnerability allows\nattackers to cause a Denial of Service (DoS) via a crafted PDF file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-46657","https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/diff/?id=b5c898a30f068b5342e8263a2cd5b9f0be291aac","https://gist.github.com/isumitpatel/615e6bd2621cb46b5d980ddb9db223e2","https://github.com/ArtifexSoftware/mupdf/commit/b5c898a30f068b5342e8263a2cd5b9f0be291aac","https://ubuntu.com/security/notices/USN-7888-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089681"],"patches":{"mupdf":[]},"tags":{},"packages":[{"name":"mupdf","source":"https://ubuntu.com/security/cve?package=mupdf","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mupdf","debian":"https://tracker.debian.org/pkg/mupdf","statuses":[{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.25.1+ds1-5build2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.25.0","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.25.1+ds1-6","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.25.1+ds1-6","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.16.1+ds1-1ubuntu1+esm2","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"released","description":"1.19.0+ds1-2ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"noble","status":"released","description":"1.23.10+ds1-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"}]}],"notices_ids":["USN-7888-1"],"notices":[{"id":"USN-7888-1","title":"MuPDF vulnerabilities","summary":"Several security issues were fixed in MuPDF.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-11-25T04:59:16.051043","description":"It was discovered that MuPDF could be made to divide by zero. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2023-51103, CVE-2023-51104, CVE-2023-51105, CVE-2023-51106)\n\nIt was discovered that MuPDF incorrectly handled memory under certain\ncircumstances, which could lead to a NULL pointer dereference. An\nattacker could potentially use this issue to cause a denial of service.\n(CVE-2024-46657)\n\nIt was discovered that MuPDF could enter an infinite recursion when\nparsing certain PDF files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2025-46206)","is_hidden":false,"release_packages":{"bionic":[{"name":"mupdf","version":"1.12.0+ds1-1ubuntu0.1~esm2","description":"A lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents","is_source":true},{"name":"libmupdf-dev","version":"1.12.0+ds1-1ubuntu0.1~esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf","version":"1.12.0+ds1-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf-tools","version":"1.12.0+ds1-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"mupdf","version":"1.16.1+ds1-1ubuntu1+esm2","description":"A lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents","is_source":true},{"name":"libmupdf-dev","version":"1.16.1+ds1-1ubuntu1+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf","version":"1.16.1+ds1-1ubuntu1+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf-tools","version":"1.16.1+ds1-1ubuntu1+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"mupdf","version":"1.19.0+ds1-2ubuntu0.1~esm1","description":"A lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents","is_source":true},{"name":"libmupdf-dev","version":"1.19.0+ds1-2ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf","version":"1.19.0+ds1-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf-tools","version":"1.19.0+ds1-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"}],"noble":[{"name":"mupdf","version":"1.23.10+ds1-1ubuntu0.1~esm1","description":"A lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents","is_source":true},{"name":"libmupdf-dev","version":"1.23.10+ds1-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf","version":"1.23.10+ds1-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"},{"name":"mupdf-tools","version":"1.23.10+ds1-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":null,"pocket":"esm-apps"}],"plucky":[{"name":"mupdf","version":"1.25.1+ds1-5ubuntu0.1","description":"A lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents","is_source":true},{"name":"libmupdf-dev","version":"1.25.1+ds1-5ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":"https://launchpad.net/ubuntu/+source/mupdf/1.25.1+ds1-5ubuntu0.1","pocket":"security"},{"name":"libmupdf25.1","version":"1.25.1+ds1-5ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":"https://launchpad.net/ubuntu/+source/mupdf/1.25.1+ds1-5ubuntu0.1","pocket":"security"},{"name":"mupdf","version":"1.25.1+ds1-5ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":"https://launchpad.net/ubuntu/+source/mupdf/1.25.1+ds1-5ubuntu0.1","pocket":"security"},{"name":"mupdf-tools","version":"1.25.1+ds1-5ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":"https://launchpad.net/ubuntu/+source/mupdf/1.25.1+ds1-5ubuntu0.1","pocket":"security"},{"name":"python3-mupdf","version":"1.25.1+ds1-5ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/mupdf","version_link":"https://launchpad.net/ubuntu/+source/mupdf/1.25.1+ds1-5ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-51106","CVE-2023-51104","CVE-2025-46206","CVE-2023-51105","CVE-2024-46657","CVE-2023-51103"]}]},{"id":"CVE-2024-54152","published":"2024-12-10T16:15:00","updated_at":"2024-12-11T09:01:13.696459+00:00","description":"\nAngular Expressions provides expressions for the Angular.JS web framework\nas a standalone module. Prior to version 1.4.3, an attacker can write a\nmalicious expression that escapes the sandbox to execute arbitrary code on\nthe system. With a more complex (undisclosed) payload, one can get full\naccess to Arbitrary code execution on the system. The problem has been\npatched in version 1.4.3 of Angular Expressions. Two possible workarounds\nare available. One may either disable access to `__proto__` globally or\nmake sure that one uses the function with just one argument.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-54152","https://github.com/peerigon/angular-expressions/commit/97f7ad94006156eeb97fc942332578b6cfbf8eef","https://github.com/peerigon/angular-expressions/security/advisories/GHSA-5462-4vcx-jh7j"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"cve is for Angular Expressions","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2024-5660","published":"2024-12-10T14:30:00","updated_at":"2025-07-11T08:00:07.367367+00:00","description":"\nUse of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2\ntranslation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE,\nCortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4,\nCortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse\nN2 may permit bypass of Stage-2 translation and/or GPT protection.","ubuntu_description":"","notes":[{"author":"eslerm","note":"u-boot is built with arm-trusted-firmware"}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2024-5660","https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660"],"bugs":[""],"patches":{"arm-trusted-firmware":[]},"tags":{},"packages":[{"name":"arm-trusted-firmware","source":"https://ubuntu.com/security/cve?package=arm-trusted-firmware","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=arm-trusted-firmware","debian":"https://tracker.debian.org/pkg/arm-trusted-firmware","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":25540,"limit":20,"total_results":79316}