{"id":163928,"date":"2026-03-11T17:11:54","date_gmt":"2026-03-11T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda"},"modified":"2026-03-11T17:11:54","modified_gmt":"2026-03-11T15:11:54","slug":"10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"10 vulnerabilit\u0103\u021bi \u00een GStreamer care conduc la executarea de cod de la distan\u021b\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen cadrul framework-ului multimedia GStreamer, utilizat \u00een GNOME, au fost identificate 10 vulnerabilit\u0103\u021bi, toate marcate ca permit\u00e2nd executarea de cod de la distan\u021b\u0103 la procesarea unor date multimedia incorect formatate \u00een formatele AVI, RTP, H.266, JPEG, ASF \u0219i RealMedia, precum \u0219i a subtitr\u0103rilor DVB-SUB. Dou\u0103 probleme au fost atribuite un nivel de severitate de 8.8 din 10, iar celelalte 7.8. Opt vulnerabilit\u0103\u021bi conduc la scrierea de date \u00een afara buffer-ului, iar dou\u0103 la o dep\u0103\u0219ire de \u00eentreg.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-3085, CVE-2026-3083 \u2014 overflow de buffer \u00een pluginul rtp, care apare din cauza lipsei unei verific\u0103ri adecvate a dimensiunii \u0219i datelor la procesarea c\u00e2mpurilor X-QDM RTP.\n<li class=\"l\"> CVE-2026-2923 \u2014 overflow de buffer la procesarea coordonatelor incorecte \u00een subtitr\u0103rile DVB-SUB.\n<li class=\"l\"> CVE-2026-3081 \u2014 overflow de buffer din cauza verific\u0103rii incorecte a dimensiunii structurilor la analiza formatului H.266 (VVC, Versatile Video Coding).\n<li class=\"l\"> CVE-2026-3082 \u2014 overflow de buffer din cauza lipsei unor verific\u0103ri adecvate a dimensiunii la analiza tabelelor Huffman \u00een imaginile JPEG.\n<li class=\"l\"> CVE-2026-2920 \u2014 overflow de buffer din cauza lipsei unor verific\u0103ri adecvate a dimensiunii la analiza antetelor containerelor multimedia \u00een format ASF.\n<li class=\"l\"> CVE-2026-2922 \u2014 overflow de buffer din cauza verific\u0103rii incorecte a structurilor la analiza containerelor multimedia \u00een format RealMedia.\n<li class=\"l\"> CVE-2026-2921 \u2014 overflow de numere \u00eentregi la analiza blocurilor RIFF cu palet\u0103 \u00een fi\u0219ierele AVI.\n<li class=\"l\"> CVE-2026-3084 \u2014 overflow de numere \u00eentregi \u00een implementarea codec-ului H.266 la analiza sec\u021biunilor cu imagini.\n<li class=\"l\"> CVE-2026-3086 \u2014 overflow de buffer \u00een implementarea codec-ului H.266 la analiza blocurilor APS.  <\/ul>\n<p>Biblioteca GStreamer este utilizat\u0103 pentru analiza fi\u0219ierelor multimedia \u00een aplica\u021biile Nautilus (GNOME Files), GNOME Videos \u0219i Rhythmbox, precum \u0219i \u00een motorul de c\u0103utare dezvoltat de GNOME, localsearch (cunoscut anterior sub numele de tracker-miners). Acest motor este instalat \u00een multe distribu\u021bii ca dependen\u021b\u0103 a pachetului tracker-extract, utilizat \u00een GNOME pentru analiza automat\u0103 a metadatelor \u00een fi\u0219ierele noi. Printre altele, acest serviciu indexeaz\u0103 toate fi\u0219ierele din directorul personal f\u0103r\u0103 nicio ac\u021biune din partea utilizatorului. Astfel, pentru a ataca, este suficient s\u0103 se asigure apari\u021bia unui fi\u0219ier multimedia creat special \u00een directorul utilizatorului, iar vulnerabilitatea va fi exploatat\u0103 \u00een timpul index\u0103rii automate.      <\/p>\n<p>\u00cen majoritatea distribu\u021biilor cu GNOME, componentele localsearch (tracker-miners) sunt activate implicit \u0219i sunt \u00eenc\u0103rcate ca dependen\u021b\u0103 strict\u0103 pentru managerul de fi\u0219iere Nautilus (GNOME Files). \u00cencep\u00e2nd cu GNOME 46, procesul localsearch este lansat folosind izola\u021bia sandbox. Pentru a dezactiva extragerea metadatelor, pute\u021bi \u0219terge fi\u0219ierele cu reguli din directorul \/usr\/share\/localsearch3\/extract-rules\/ sau \/usr\/share\/tracker3-miners\/extract-rules\/.          <\/p>\n<p>Vulnerabilit\u0103\u021bile au fost remediate \u00een actualizarea GStreamer 1.28.1. Starea remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat\u0103 pe aceste pagini (dac\u0103 pagina nu este disponibil\u0103, \u00eenseamn\u0103 c\u0103 dezvoltatorii distribu\u021biei nu au \u00eenceput \u00eenc\u0103 examinarea problemei): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, FreeBSD.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64964\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 AVI, RTP, H.266, JPEG, ASF \u0438 RealMedia, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0443\u0431\u0442\u0438\u0442\u0440\u043e\u0432 DVB-SUB. \u0414\u0432\u0443\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u043c 7.8. \u0412\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163928","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-11T15:11:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4710 vulnerabilit\u0103\u021bi \u00een GStreamer, care duc la execu\u021bia de cod de la distan\u021b\u0103 | ProHoster","description":"\u00cen cadrul framework-ului multimedia GStreamer, utilizat \u00een GNOME, au fost identificate 10 vulnerabilit\u0103\u021bi, toate fiind marcate ca permit\u00e2nd execu\u021bia de cod de la distan\u021b\u0103 atunci c\u00e2nd se proceseaz\u0103 date multimedia formate incorect.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GStreamer, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0445 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 GStreamer, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 GNOME, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u0441\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-11T15:11:54+00:00","article:modified_time":"2026-03-11T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/163928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=163928"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/163928\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=163928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=163928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=163928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}