GoogleOSV:SUSE-SU-2024:3289-1Security update for gstreamer-plugins-bad, libvpl
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
AI Score
Confidence
High
This update for gstreamer-plugins-bad, libvpl fixes the following issues:
- Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
The libmfx dependency is replaced by libvpl.
References
bugzilla.suse.com/1218534
bugzilla.suse.com/1219494
bugzilla.suse.com/1223263
bugzilla.suse.com/1226892
bugzilla.suse.com/1226897
bugzilla.suse.com/1226898
bugzilla.suse.com/1226899
bugzilla.suse.com/1226900
bugzilla.suse.com/1226901
www.suse.com/security/cve/CVE-2023-22656
www.suse.com/security/cve/CVE-2023-45221
www.suse.com/security/cve/CVE-2023-47169
www.suse.com/security/cve/CVE-2023-47282
www.suse.com/security/cve/CVE-2023-48368
www.suse.com/security/cve/CVE-2023-50186
www.suse.com/support/update/announcement/2024/suse-su-20243289-1/
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
AI Score
Confidence
High