RLSA-2026:36674

Synopsis

Moderate: gstreamer1-plugins-ugly-free security update

Description

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 9 aarch64 Rocky Linux 9 ppc64le Rocky Linux 9 x86_64

Fixes

2487613 2487614

CVEs

CVE-2026-53703 CVE-2026-53704

Affected packages

Rocky Linux 9 aarch64 - AppStream

gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.aarch64.rpm gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.src.rpm gstreamer1-plugins-ugly-free-debuginfo-0:1.22.12-6.el9_8.1.aarch64.rpm gstreamer1-plugins-ugly-free-debugsource-0:1.22.12-6.el9_8.1.aarch64.rpm

Rocky Linux 9 x86_64 - AppStream

gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.i686.rpm gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.src.rpm gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.x86_64.rpm gstreamer1-plugins-ugly-free-debuginfo-0:1.22.12-6.el9_8.1.i686.rpm gstreamer1-plugins-ugly-free-debuginfo-0:1.22.12-6.el9_8.1.x86_64.rpm gstreamer1-plugins-ugly-free-debugsource-0:1.22.12-6.el9_8.1.i686.rpm gstreamer1-plugins-ugly-free-debugsource-0:1.22.12-6.el9_8.1.x86_64.rpm

Rocky Linux 9 ppc64le - AppStream

gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.ppc64le.rpm gstreamer1-plugins-ugly-free-0:1.22.12-6.el9_8.1.src.rpm gstreamer1-plugins-ugly-free-debuginfo-0:1.22.12-6.el9_8.1.ppc64le.rpm gstreamer1-plugins-ugly-free-debugsource-0:1.22.12-6.el9_8.1.ppc64le.rpm