RHSA-2025:18416 - Security Advisory

Topic

An update for gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server is now available for Red Hat In-Vehicle-OS version 1.0.0.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data.

Security Fix(es):

• gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)
• gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat In-Vehicle-OS version 1.0.0 Release Notes linked from the References section.

Solution

To update your implementation of Red Hat In-Vehicle Operating System,contact Red Hat Support: https://access.redhat.com/support.

Affected Products

• Red Hat In-Vehicle Operating System Core 1 x86_64
• Red Hat In-Vehicle Operating System Core 1 aarch64

Fixes

• BZ - 2282999 - CVE-2024-4453 gstreamer: EXIF Metadata Parsing Integer Overflow
• BZ - 2292335 - CVE-2024-0444 gstreamer: AV1 Video Parsing Stack-based Buffer Overflow

CVEs

• CVE-2024-0444
• CVE-2024-4453

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.redhat.com/en/documentation/red_hat_in_vehicle_os/1.0/html/1.0_release_notes/index
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/indexhttps://access.redhat.com/security/updates/classification/#moderate