The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6489 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6489-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 08, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     CVE ID         : CVE-2026-18297

    An buffer overflow was discovered in the OPUS audio decoder of the     GStreamer media framework, which may result in denial of service     or potentially the execution of arbitrary code if a malformed     audio file is processed.

    For the stable distribution (trixie), this problem has been fixed in     version 1.26.2-1+deb13u2.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69531 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

    Security Fix(es):

    * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0312 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-18297:
    GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    User interaction is required to exploit this vulnerability in that the target must visit a malicious page     or open a malicious file.
    The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper     validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker     can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584.

    CVE-2026-85150:
    A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs     while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially     crafted whitespace placement around a parameter's terminator can cause an internal length calculation to     underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered     by a remote, unauthenticated attacker sending a single malformed request when the server has     authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or     compromised RTSP server. Successful exploitation results in a denial of service (application crash) and     has no confirmed impact on confidentiality or integrity.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4828 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4828-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 08, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gst-plugins-base1.0     Version        : 1.22.0-3+deb12u7     CVE ID         : CVE-2026-18297 CVE-2026-85150

    Multiple vulnerabilities has been discovered in the base set of plugins and     supporting libraries for GStreamer, a framework for processing audio and video     streams.

    CVE-2026-18297

        An buffer overflow was discovered in the OPUS audio decoder of the         GStreamer media framework, which may result in denial of service         or potentially the execution of arbitrary code if a malformed         audio file is processed.

    CVE-2026-85150

        Roy Lau discovered a NULL pointer dereference in GStreamer's RTSP library         when parsing Digest authentication headers. A remote attacker could exploit         this flaw to cause a denial of service (application crash) by sending a         specially crafted request to an RTSP server with authentication enabled, or         by supplying a crafted response to an RTSP client from a malicious server.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.0-3+deb12u7.

    We recommend that you upgrade your gst-plugins-base1.0 packages.

    For the detailed security status of gst-plugins-base1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-base1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
343872	Debian dsa-6489 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	2026/9/8	2026/9/18	high
348688	RHEL 8 : gstreamer1-plugins-base (RHSA-2026:69531)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/21	high
367780	Alibaba Cloud Linux 3 : 0312: gstreamer1-plugins-base (ALINUX3-SA-2026:0312)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/10/20	2026/10/20	high
367988	Debian dla-4828 : gir1.2-gst-plugins-base-1.0 - security update	Nessus	Debian Local Security Checks	2026/10/20	2026/10/20	high

检测

插件搜索

high

high

high

high