The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0657 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-44429:
    GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation.

    The specific flaw exists within the parsing of AV1 encoded video files. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-22226.

    CVE-2023-44446:
    A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files.
    This issue could allow a malicious third party to trigger a crash in the application and may allow code     execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1-plugins-bad-free packages installed that are affected by multiple vulnerabilities:

  - GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of metadata within AV1     encoded video files. The issue results from the lack of proper validation of the length of user-supplied     data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability     to execute code in the context of the current process. Was ZDI-CAN-22300. (CVE-2023-50186)

  - GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of AV1 encoded video files.
    The issue results from the lack of proper validation of the length of user-supplied data prior to copying     it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-22226. (CVE-2023-44429)

  - GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the     lack of validating the existence of an object prior to performing operations on the object. An attacker     can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.
    (CVE-2023-44446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7bd66f219f advisory.

    Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2355 advisory.

    gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)

    gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6526-1 advisory.

    It was discovered that GStreamer Bad Plugins incorrectly handled certain media files. A remote attacker     could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-1661e0af22 advisory.

    Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4874-1 advisory.

  - Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)    (CVE-2023-44429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7048:03 advisory.

    * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)
      * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-6a4aea6d13 advisory.

    1.22.7



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239194	TencentOS Server 4: gstreamer1-plugins-bad-free (TSSA-2024:0657)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
242721	NewStart CGSL MAIN 7.02 : gstreamer1-plugins-bad-free Multiple Vulnerabilities (NS-SA-2025-0163)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
186455	Fedora 38 : gst-devtools / gstreamer1 / gstreamer1-doc / python-gstreamer1 (2023-7bd66f219f)	Nessus	Fedora Local Security Checks	2023/11/29	2024/11/15	high
186557	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2023-2355)	Nessus	Amazon Linux Local Security Checks	2023/12/4	2024/12/11	high
186441	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GStreamer Bad Plugins vulnerabilities (USN-6526-1)	Nessus	Ubuntu Local Security Checks	2023/11/29	2024/12/17	high
204259	Photon OS 4.0: Gstreamer PHSA-2023-4.0-0523	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/11/4	high
185984	Fedora 39 : gst-devtools / gstreamer1 / gstreamer1-doc / python-gstreamer1 (2023-1661e0af22)	Nessus	Fedora Local Security Checks	2023/11/18	2024/11/14	high
187018	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-bad (SUSE-SU-2023:4874-1)	Nessus	SuSE Local Security Checks	2023/12/15	2023/12/15	high
293702	MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.1-2.el9_3 (AXSA:2023-7048:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
185982	Fedora 39 : gstreamer1-plugin-libav / gstreamer1-plugins-bad-free / etc (2023-6a4aea6d13)	Nessus	Fedora Local Security Checks	2023/11/18	2024/12/17	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high