Synopsis

Moderate: gstreamer-plugins-base security update

Type/Severity

Security Advisory: Moderate

Topic

Updated gstreamer-plugins-base packages that fix a security issue are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

GStreamer is a streaming media framework based on graphs of filters which
operate on media data. GStreamer Base Plug-ins is a collection of
well-maintained base plug-ins.

An integer overflow flaw which caused a heap-based buffer overflow was
discovered in the Vorbis comment tags reader. An attacker could create a
carefully-crafted Vorbis file that would cause an application using
GStreamer to crash or, potentially, execute arbitrary code if opened by a
victim. (CVE-2009-0586)

All users of gstreamer-plugins-base are advised to upgrade to these updated
packages, which contain a backported patch to correct this issue. After
installing this update, all applications using GStreamer (such as Totem or
Rhythmbox) must be restarted for the changes to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc

Fixes

• BZ - 488208 - CVE-2009-0586 gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()

CVEs

• CVE-2009-0586

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
x86_64
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: c5cc72995077106b993da1004be167760f7f708d96e916fa065a9d91658415a9
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: 12ed1d1b916966aa9243348f3d105a9572387318a161f0979d34991a5e2072d9
ia64
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.ia64.rpm	SHA-256: d3c26831c7d80408062b9f5987ace79f4f344d6452fd9ffda511f0f360dd2f1d
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.ia64.rpm	SHA-256: 09299b40afa08af1543bc8c0e7417ad3b31c3b7a79d06ad919e3034bc382c5d9
i386
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a

Red Hat Enterprise Linux Workstation 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
x86_64
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: c5cc72995077106b993da1004be167760f7f708d96e916fa065a9d91658415a9
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: 12ed1d1b916966aa9243348f3d105a9572387318a161f0979d34991a5e2072d9
i386
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a

Red Hat Enterprise Linux Desktop 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
x86_64
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: c5cc72995077106b993da1004be167760f7f708d96e916fa065a9d91658415a9
i386
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
s390x
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.s390.rpm	SHA-256: c76c8b23494c1469c17674b2190a0bda0bfbbb12b278cf156f890d4dca47e3e3
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.s390x.rpm	SHA-256: 2d3ee5ee5f691feb4b3779714348a9e883d0b5dc85a82266ce736011839fd721
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.s390.rpm	SHA-256: 9931595e2802601f0684c019754f47c70a1c0cf13d60dbb836563d4142b455ba
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.s390x.rpm	SHA-256: 96504df2d08ad45342cff314bf701668d03c42be91c3830a36ccae80d991307d

Red Hat Enterprise Linux for Power, big endian 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
ppc
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.ppc.rpm	SHA-256: e1677766a09ca6063bc489514d5a12982221abb871474df13e6052c2cbad35f7
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.ppc64.rpm	SHA-256: bed9a9a887ee7f39125380b16808ea6e9cefd70b1a79e1d28e3a894258847f3c
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.ppc.rpm	SHA-256: d52d7416b43feed961035abebd8841d5af1a86ade87b0b9612c7a1cd641a734f
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.ppc64.rpm	SHA-256: 8687f77d7c30107d0964f128e3287d6e572b5ea719eaec706bc958a81eebfe7e

Red Hat Enterprise Linux Server from RHUI 5

SRPM
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.src.rpm	SHA-256: fad8ff5a4a15d9045cab2e2ea04169aad444fe4a5fb88fd9e11d0bfbbdaf3c08
x86_64
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: c5cc72995077106b993da1004be167760f7f708d96e916fa065a9d91658415a9
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.x86_64.rpm	SHA-256: 12ed1d1b916966aa9243348f3d105a9572387318a161f0979d34991a5e2072d9
i386
gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 56a6a620fd5b4ee5cf819e72f6ef7891944e685910717f7f35022d05d81f0c05
gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	SHA-256: 8b028ec9cef243711cbf2b88279370cc12cc1c41d4c710a71ac35b6f33a1690a