The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7178 advisory.

    gstreamer1     [1.22.12-3]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-2]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-1]
    - Update to 1.22.12

    [1.22.9-1]
    - 1.22.9

    [1.22.8-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-1]
    - 1.22.8

    [1.22.7-2]
    - Set cap information correctly
    - Resolves: rhbz#2238703

    [1.22.7-1]
    - 1.22.7

    [1.22.6-1]
    - 1.22.6

    [1.22.5-1]
    - Update to 1.22.5

    [1.22.4-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

    [1.22.4-1]
    - 1.22.4

    [1.22.3-2]
    - Do setcap on gst-ptp-helper to give the right permissions.

    [1.22.3-1]
    - Update to 1.22.3

    [1.22.2-1]
    - Update to 1.22.2

    [1.22.1-1]
    - Update to 1.22.1

    [1.22.0-1]
    - Update to 1.22.0

    [1.21.90-1]
    - Update to 1.21.90

    [1.20.5-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

    [1.20.5-1]
    - Update to 1.20.5

    gstreamer1-plugins-bad-free     [1.22.12-3]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-2]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-1]
    - 1.22.12

    [1.22.11-1]
    - 1.22.11

    [1.22.9-3]
    - Add gstreamer1-plugin-openh264 subpackage with the openh264 plugin

    [1.22.9-2]
    - Rebuilt for opencv-4.9.0

    [1.22.9-1]
    - 1.22.9

    [1.22.8-5]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-4]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-3]
    - Backport of 'va: fixes for Mesa driver'
    - Resolves: rhbz#2256693

    [1.22.8-2]
    - Enable dvbsuboverlay and siren plugins
    - Enable avtp, dtsdec, and flite plugins in extras

    [1.22.8-1]
    - 1.22.8

    [1.22.7-2]
    - Move gstva from extras into main package

    [1.22.7-1]
    - 1.22.7

    [1.22.5-2]
    - Separate libs subpackage
    - Enable opencv as separate subpackage

    [1.22.5-1]
    - Update to 1.22.5

    [1.22.3-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

    [1.22.3-1]
    - Update to 1.22.3

    [1.22.2-4]
    - Remove obsolete of plugins-bad-freeworld to workaround a dnf bug       https://bugzilla.redhat.com/show_bug.cgi?id=1867376#c9

    [1.22.2-3]
    - Fix migration of musepack and voamrwbenc to -bad-free-extras

    [1.22.2-2]
    - Enable musepack and voamrwbenc in extras

    [1.22.2-1]
    - Update to 1.22.2

    [1.22.1-1]
    - Update to 1.22.1

    [1.22.0-1]
    - Update to 1.22.0

    [1.21.90-1]
    - Update to 1.21.90

    [1.20.5-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

    [1.20.5-1]
    - Update to 1.20.5
    - Remove unwanted crypto dependencies.

    [1.20.4-2]
    - Drop vdpau configure option
    - The libgstva plugin is now excluded from file listings when disabled
    - Resolves: rhbz#2141093

    gstreamer1-plugins-ugly-free     [1.22.12-3]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-2]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-1]
    - 1.22.12

    [1.22.11-1]
    - 1.22.11

    [1.22.9-1]
    - 1.22.9

    [1.22.8-4]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-2]
    - Enable asfdemux, dvdlpcmdec, dvdsub, and realmedia plugins
    - Disable AMR plugins in RHEL builds
    - Resolves: rhbz#2236889

    [1.22.8-1]
    - 1.22.8

    [1.22.7-1]
    - 1.22.7

    [1.22.5-1]
    - Update to 1.22.5

    [1.22.3-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

    [1.22.3-1]
    - Update to 1.22.3

    [1.22.2-1]
    - Update to 1.22.2

    [1.22.1-2]
    - Rebuild for new AMR plugins.

    gstreamer1-rtsp-server     [1.22.12-3]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-2]
    - Rebuild
    - Resolves: RHEL-38511, RHEL-41157

    [1.22.12-1]
    - 1.22.12

    [1.22.11-1]
    - 1.22.11

    [1.22.9-1]
    - 1.22.9

    [1.22.8-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    [1.22.8-1]
    - 1.22.8

    [1.22.7-1]
    - 1.22.7

    [1.22.5-1]
    - Update to 1.22.5

    [1.22.3-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

    [1.22.3-1]
    - Update to 1.22.3

    [1.22.2-1]
    - Update to 1.22.2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0072 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-0444:
    GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation.
    The specific flaw exists within the parsing of tile list data within AV1-encoded video files. The issue     results from the lack of proper validation of the length of user-supplied data prior to copying it to a     fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-22873.

    CVE-2024-4453:
    GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.
    The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper     validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process.
    . Was ZDI-CAN-23896.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of tile list data within     AV1-encoded video files. The issue results from the lack of proper validation of the length of user-     supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this     vulnerability to execute code in the context of the current process. Was ZDI-CAN-22873. (CVE-2024-0444)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7178 advisory.

    * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)
      * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_7178 advisory.

    * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)

    * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

ID	名稱	產品	系列	已發布	已更新	嚴重性
237047	Oracle Linux 9 : gstreamer1, / gstreamer1-plugins-bad-free, / gstreamer1-plugins-ugly-free, / and / gstreamer1-rtsp-server (ELSA-2025-7178)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	high
237275	Alibaba Cloud Linux 3 : 0072: gstreamer1-plugins-bad-free (ALINUX3-SA-2025:0072)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/27	2025/5/27	high
227579	Linux Distros Unpatched Vulnerability : CVE-2024-0444	Nessus	Misc.	2025/3/5	2026/11/5	high
241286	AlmaLinux 9 : gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server (ALSA-2025:7178)	Nessus	Alma Linux Local Security Checks	2025/7/3	2025/7/3	high
355130	Rocky Linux 9 [CIQ] Security Update: gstreamer1 / gstreamer1-debuginfo / gstreamer1-debugsource / etc Multiple Vulnerabilities (crlsa-2025_7178)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
204259	Photon OS 4.0: Gstreamer PHSA-2023-4.0-0523	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/11/2	high

偵測

搜尋 Plugin

high

high

high

high

high

high