Ubuntu alert USN-8855-1 (gst-plugins-bad1.0)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8855-1] GStreamer Bad Plugins vulnerability
Date:
             
 
Thu, 01 Oct 2026 07:15:20 +0000
Message-ID:
             
 
<E1xCB0i-0007Z2-Qg@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8855-1
September 30, 2026

gst-plugins-bad1.0 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

GStreamer Bad Plugins could be made to crash or run programs as your login
if it opened a specially crafted file.

Software Description:
- gst-plugins-bad1.0: GStreamer plugins

Details:

It was discovered that GStreamer Bad Plugins incorrectly validated the size
of multi-channel audio blocks. An attacker could possibly use this  issue
with a specially crafted WAV file to cause the program to crash, resulting
in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  gstreamer1.0-plugins-bad        1.28.2-1ubuntu1.2

Ubuntu 24.04 LTS
  gstreamer1.0-plugins-bad        1.24.2-1ubuntu4+esm2
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  gstreamer1.0-plugins-bad        1.20.3-0ubuntu1.1+esm3
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  gstreamer1.0-plugins-bad        1.16.3-0ubuntu1.1+esm2
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  gstreamer1.0-plugins-bad        1.14.5-0ubuntu1~18.04.1+esm2
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  gstreamer1.0-plugins-bad        1.8.3-1ubuntu0.2+esm2
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  gstreamer1.0-plugins-bad        1.2.4-1~ubuntu1.1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8855-1
  CVE-2026-19387

Package Information:
  https://launchpad.net/ubuntu/+source/gst-plugins-bad1.0/1...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq+CHMACgkQcpJm3tlz
hgHdCRAAodM/GrfIDEzwDkVhd/IAvDMkqH1QDyvDj6qe2dRQ89rQHRM6vGa7ODGV
5bylsu9zor4mI0jfC0u4I6mIPnSoJ+c68XAbKHi8LC6Udrp0uWQHOTZR2u5oQFFZ
tH0M7Kjvyq94kgk5QwBghZrufGZGq8VuOUQ+UoF0fKZ9R1N1d8Hw21eQDDip3Rxt
adblfOFGwOveSovJTBvW72mHqjcme9JYhbo5C7GFditY1DkHOsG1t/Ej5UABfU48
WYoqcQ1Ps154ksrl4hWDmtK3iIN/7qf24t1Nm0X2DdKm7u07gr2XQ9Q52f4NoJDs
J+McA/8C5Bt21YZErlBKxPWDuOHqQkMqTc2Ev04LC/O+XXlsRBhTf0GPLnFLwOkZ
Ae+ldAn6nER8sJF1tcJt8b2iaVSJ5E8ttNXUlobIwwDcAFJ4iqksIaAdtcUKWIU2
nnXuMqjPWvB24MIoPJ0SR4nn4wdQhmXZ4qd/HecPn+CaOxAmOVrEwvX1LHZAmqqO
chGCHMRLs+g5FV48Vhv1LUvtY4+NUUbBzvSEoOPV7pNbjfevzU35i3AXQQ93WHAd
mpKB4JGZn0TfC7FuNmeknDdNwBsAsCb64O1JP8LbLt6L/KWWijZv/lsnmwP/mm36
X2sCNPqD0KaLXDTFllJzVXX91vhWRzF4XVWwmdK7avhimH/gzCs=
=iCCh
-----END PGP SIGNATURE-----