Debian alert DLA-4371-1 (gst-plugins-base1.0)

From:
             
 
Jeremy Bicha <jbicha@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4371-1] gst-plugins-base1.0 security update
Date:
             
 
Fri, 14 Nov 2025 12:35:32 -0500
Message-ID:
             
 
<159d76045985dc59e2f6a9447798d5fb9e001a6b.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4371-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                        Jeremy Bícha
November 14, 2025                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : gst-plugins-base1.0
Version        : 1.18.4-2+deb11u4
CVE ID         : CVE-2025-47806 CVE-2025-47807 CVE-2025-47808

Multiple vulnerabilities were fixed in the subparse plugin of
gst-plugins-base1.0. GStreamer is a popular multimedia framework.

CVE-2025-47806: Fix DoS via stack overflow in subparse plugin

CVE-2025-47807: Fix DoS via null-deref in subparse plugin

CVE-2025-47808: Fix DoS via null-deref in subparse plugin

For Debian 11 bullseye, these problems have been fixed in version
1.18.4-2+deb11u4.

We recommend that you upgrade your gst-plugins-base1.0 packages.

For the detailed security status of gst-plugins-base1.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gst-plugins-b...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmkXaGQACgkQ5mx3Wuv+
bH1gqA//SIZ2xmfoDn0NYs3BwMZHVq76Itr2HedwvlMM1pHLpJZDYZ4V92yX5d8p
ZKhecfs6auPlZYyI904eeKlPFS0mdoTlq/GWGAbHY41PLm0euAQJzVi0ZLrp1HoM
IwqKrvIrRAcAfcNDqrOVWdFtV+LjwfFjajPZbbJCVmK61r+WleRu+7x8YpB37BA3
cEBUnGDHptQebfFtsYS9qavcFv4VlV2dS7AJniE7s+E3MOYPWXPr+Q8obkfs5FUC
ZWXrQPMMKSvn0Ykut9K8mMXiJjvX8mXozvt5zkgucCTwdXSlrY+MILiQB0xRlvXO
y38ETeujrKGbY8llc35pYm/s+oNnLOg0jeV5YbrV3j5ugb1ALh8TvzYcMgfv3pcQ
8NQqzwPI5X+AeehPQooLbqZ7XRG+B1zQna65XEi6iRqWJAwD/ZoWofEoBfFo08J0
sf4H9P8+RlLt8GmvLDl5MZyAYs/+Vi4LvddrxIuEtAzXt/1SJZG42rbxYA+MD1Qo
Xt7lzy+MHPlwgkLzP6/7kPojqxEnnZx3iINkselJy2Ho+ygr8808JWcZEee6Op7q
no8fj2RHL3Y/vM3ZJG1f2ahUT5XTcQfUbuBYu/o8/xqFDCcoMrZXSc9/D2/w7ZgE
hMHvas2dENEGLGZwZOcOeU4qGI1TjnsDLmjwkVBdyLcNP4S99Bc=
=vk5e
-----END PGP SIGNATURE-----