{"id":163928,"date":"2026-03-11T17:11:54","date_gmt":"2026-03-11T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda"},"modified":"2026-03-11T17:11:54","modified_gmt":"2026-03-11T15:11:54","slug":"10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"10 haavatavust GStreameris, mis v\u00f5ivad viia koodi kaugteostuseni","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>GNOME'i multimeedia raamistiku GStreameris on tuvastatud 10 haavatavust, millest k\u00f5ik on t\u00e4histatud kui v\u00f5imaldavad kaugteostust, kui t\u00f6\u00f6tletakse valesti vormindatud multimeedia andmeid formaatides AVI, RTP, H.266, JPEG, ASF ja RealMedia ning DVB-SUB subtiitreid. Kahele probleemile on m\u00e4\u00e4ratud ohutaseme hinne 8.8 10-st, \u00fclej\u00e4\u00e4nutele 7.8. Kaheksa haavatavust p\u00f5hjustavad andmete kirjutamist v\u00e4ljaspool puhvers ang ja kaks arvu \u00fcletamist.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-3085, CVE-2026-3083 \u2012 puhangu \u00fclevool rtp pistikus, mis tuleneb puudulikust suuruse ja andmete kontrollimisest X-QDM RTP v\u00e4ljade t\u00f6\u00f6tlemisel.\n<li class=\"l\"> CVE-2026-2923 \u2012 puhangu \u00fclevool vale koordinaatide t\u00f6\u00f6tlemisel DVB-SUB subtiitrites.\n<li class=\"l\"> CVE-2026-3081 \u2012 puhangu \u00fclevool vale struktuuride suuruse kontrollimise t\u00f5ttu H.266 (VVC, Versatile Video Coding) formaadi anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-3082 \u2012 puhangu \u00fclevool puudulike suuruse kontrollide t\u00f5ttu JPEG piltide Huffmani tabelite anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-2920 \u2012 puhangu \u00fclevool puudulike suuruse kontrollide t\u00f5ttu ASF formaadi multimeedia konteinerite peade anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-2922 \u2012 puhangu \u00fclevool vale struktuuride kontrollimise t\u00f5ttu RealMedia formaadi multimeedia konteinerite anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-2921 \u2012 t\u00e4isarvude \u00fclevool AVI failide paleti RIFF-plokkide anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-3084 \u2012 t\u00e4isarvude \u00fclevool H.266 kodeerija realiseerimisel piltide sektsioonide anal\u00fc\u00fcsimisel.\n<li class=\"l\"> CVE-2026-3086 \u2012 puhangu \u00fclevool H.266 kodeerija realiseerimisel APS-plokkide anal\u00fc\u00fcsimisel.  <\/ul>\n<p>GStreamer teek kasutatakse multimeedia failide anal\u00fc\u00fcsimiseks rakendustes Nautilus (GNOME Files), GNOME Videos ja Rhythmbox, samuti GNOME'i arendatavas lokaalotsingu mootoris localsearch (varem tuntud kui tracker-miners). See mootor paigaldatakse paljudesse distributsioonidesse s\u00f5ltuvusena paketist tracker-extract, mida GNOME kasutab uute failide metainformatsiooni automaatseks anal\u00fc\u00fcsimiseks. Muuhulgas indekseerib see teenus automaatselt k\u00f5ik failid kasutaja kodukaustas, ilma et kasutaja peaks midagi tegema. Seega piisab r\u00fcnnaku korral, kui kasutaja kodukausta satub spetsiaalselt loodud multimeedia fail, ning haavatavust saab \u00e4ra kasutada selle automaatse indekseerimise ajal.      <\/p>\n<p>Enamikus GNOME jaotustes aktiveeritakse localsearch (tracker-miners) komponendid vaikimisi ja need laaditakse sisse kui Nautiluse (GNOME Files) failihalduri tugev s\u00f5ltuvus. Alates GNOME 46 k\u00e4ivitatakse localsearch protsess liivakasti isoleerituna. Metaandmete eraldamise keelamiseks saab eemaldada reeglifailid kataloogist \/usr\/share\/localsearch3\/extract-rules\/ v\u00f5i \/usr\/share\/tracker3-miners\/extract-rules\/.          <\/p>\n<p>Haavatavused on k\u00f5rvaldatud GStreamer 1.28.1 v\u00e4rskenduses. Haavatavuste k\u00f5rvaldamise staatus jaotusversioonides saab hinnata nendel lehtedel (kui leht on kergesti ligip\u00e4\u00e4smatu, t\u00e4hendab see, et jaotuse arendajad ei ole veel probleemi k\u00e4sitlemisega alustanud): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, FreeBSD.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64964\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 AVI, RTP, H.266, JPEG, ASF \u0438 RealMedia, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0443\u0431\u0442\u0438\u0442\u0440\u043e\u0432 DVB-SUB. \u0414\u0432\u0443\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u043c 7.8. \u0412\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163928","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4710 haavatavust GStreameris, mis viivad kaugk\u00e4itamise v\u00f5imaldavate koodideni | ProHoster","description":"Multimeedia raamistikus GStreamer, mida kasutatakse GNOME'is, avastati 10 haavatavust, millest k\u00f5ik on t\u00e4histatud kui kaugk\u00e4itamise v\u00f5imaldavad koodid vigaselt vormindatud multimeedia andmete t\u00f6\u00f6tlemisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-11T15:11:54+00:00","article:modified_time":"2026-03-11T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/163928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=163928"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/163928\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=163928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=163928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=163928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}