{"id":163928,"date":"2026-03-11T17:11:54","date_gmt":"2026-03-11T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda"},"modified":"2026-03-11T17:11:54","modified_gmt":"2026-03-11T15:11:54","slug":"10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"10 vulnerabilidades no GStreamer, levando \u00e0 execu\u00e7\u00e3o remota de c\u00f3digo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>No framework multim\u00eddia GStreamer, utilizado no GNOME, foram identificadas 10 vulnerabilidades, todas marcadas como permitindo execu\u00e7\u00e3o remota de c\u00f3digo ao processar dados multim\u00eddia malformados nos formatos AVI, RTP, H.266, JPEG, ASF e RealMedia, assim como legendas DVB-SUB. Duas das quest\u00f5es receberam um n\u00edvel de gravidade de 8.8 em 10 e as outras 7.8. Oito vulnerabilidades causam escrita de dados al\u00e9m do buffer, e duas causam estouro de inteiro.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-3085, CVE-2026-3083 \u2014 estouro de buffer no plugin rtp, causado pela falta de verifica\u00e7\u00e3o adequada do tamanho e dos dados ao processar os campos X-QDM RTP.\n<li class=\"l\"> CVE-2026-2923 \u2014 estouro de buffer ao processar coordenadas incorretas nas legendas DVB-SUB.\n<li class=\"l\"> CVE-2026-3081 \u2014 estouro de buffer devido \u00e0 verifica\u00e7\u00e3o incorreta do tamanho das estruturas ao analisar o formato H.266 (VVC, Versatile Video Coding).\n<li class=\"l\"> CVE-2026-3082 \u2014 estouro de buffer pela falta de verifica\u00e7\u00f5es adequadas do tamanho ao analisar tabelas de Huffman em imagens JPEG.\n<li class=\"l\"> CVE-2026-2920 \u2014 estouro de buffer devido \u00e0 aus\u00eancia de verifica\u00e7\u00f5es adequadas do tamanho ao analisar os cabe\u00e7alhos de cont\u00eaineres multim\u00eddia no formato ASF.\n<li class=\"l\"> CVE-2026-2922 \u2014 estouro de buffer devido \u00e0 verifica\u00e7\u00e3o incorreta das estruturas ao analisar cont\u00eaineres multim\u00eddia no formato RealMedia.\n<li class=\"l\"> CVE-2026-2921 \u2014 estouro inteiro ao analisar blocos RIFF com paleta em arquivos AVI.\n<li class=\"l\"> CVE-2026-3084 \u2014 estouro inteiro na implementa\u00e7\u00e3o do codec H.266 ao analisar se\u00e7\u00f5es com imagens.\n<li class=\"l\"> CVE-2026-3086 \u2014 estouro de buffer na implementa\u00e7\u00e3o do codec H.266 ao analisar blocos APS.  <\/ul>\n<p>A biblioteca GStreamer \u00e9 utilizada para analisar arquivos multim\u00eddia em aplicativos Nautilus (GNOME Files), GNOME Videos e Rhythmbox, assim como no motor de busca localsearch (anteriormente chamado de tracker-miners), desenvolvido pelo GNOME. Este motor \u00e9 instalado em v\u00e1rias distribui\u00e7\u00f5es como depend\u00eancia do pacote tracker-extract, utilizado no GNOME para a an\u00e1lise autom\u00e1tica de metadados em novos arquivos. Entre outras coisas, este servi\u00e7o indexa todos os arquivos no diret\u00f3rio pessoal sem nenhuma a\u00e7\u00e3o por parte do usu\u00e1rio. Assim, para um ataque, basta que um arquivo multim\u00eddia especificamente criado apare\u00e7a no diret\u00f3rio do usu\u00e1rio e a vulnerabilidade ser\u00e1 explorada durante sua indexa\u00e7\u00e3o autom\u00e1tica.      <\/p>\n<p>Na maioria das distribui\u00e7\u00f5es com GNOME, os componentes localsearch (tracker-miners) s\u00e3o ativados por padr\u00e3o e carregados como uma depend\u00eancia r\u00edgida do gerenciador de arquivos Nautilus (GNOME Files). A partir do GNOME 46, o processo localsearch \u00e9 iniciado com o uso de isolamento sandbox. Para desativar a extra\u00e7\u00e3o de metadados, \u00e9 poss\u00edvel remover os arquivos de regras do diret\u00f3rio \/usr\/share\/localsearch3\/extract-rules\/ ou \/usr\/share\/tracker3-miners\/extract-rules\/.          <\/p>\n<p>As vulnerabilidades foram corrigidas na atualiza\u00e7\u00e3o do GStreamer 1.28.1. O status da corre\u00e7\u00e3o das vulnerabilidades nas distribui\u00e7\u00f5es pode ser avaliado nas seguintes p\u00e1ginas (se a p\u00e1gina n\u00e3o estiver acess\u00edvel, significa que os desenvolvedores da distribui\u00e7\u00e3o ainda n\u00e3o come\u00e7aram a abordar o problema): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, FreeBSD.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64964\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 AVI, RTP, H.266, JPEG, ASF \u0438 RealMedia, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0443\u0431\u0442\u0438\u0442\u0440\u043e\u0432 DVB-SUB. \u0414\u0432\u0443\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u043c 7.8. \u0412\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163928","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4710 vulnerabilidades no GStreamer que permitem execu\u00e7\u00e3o remota de c\u00f3digo | ProHoster","description":"No framework multim\u00eddia GStreamer, utilizado no GNOME, foram identificadas 10 vulnerabilidades, todas marcadas como permitindo execu\u00e7\u00e3o remota de c\u00f3digo ao processar dados multim\u00eddia malformados.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-11T15:11:54+00:00","article:modified_time":"2026-03-11T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/163928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=163928"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/163928\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=163928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=163928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=163928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}