Backport upstream commit 9bb455393b to fix CVE-2026-59692,
a buffer overflow in ext/dtls/gstdtlsconnection.c where a
fixed 2048-byte stack buffer was used to store the peer
certificate subject DN. The fix replaces the stack buffer
with a dynamically allocated buffer sized to the actual
length returned by X509_NAME_print_ex(), and adds proper
error handling for the length check and BIO_read() call.
The patch was manually rebased to account for line number
differences between the upstream monorepo layout and the
RHEL 8 standalone source tree.
CVE: CVE-2026-59692
Upstream patches:
- 9bb455393b.patch
Resolves: RHEL-193570
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport two upstream commits (85cdda97 and 340428be) from
GStreamer monorepo MR !12054 to fix CVE-2026-59691 in
gstreamer1-plugins-bad-free.
The patches fix rfbsrc/librfb vulnerabilities in rfbdecoder.c:
- Use correct bytes-per-pixel (bpp) for copying hextile data
in rfb_decoder_fill_rectangle.
- Read the correct number of bytes for color values in RRE,
CoRRE, and Hextile encodings via a new rfb_decoder_get_pixel()
helper function.
Added as Patch8 (0001-rfbsrc-CVE-2026-59691.patch).
CVE: CVE-2026-59691
Upstream patches:
- 85cdda978b.patch
- 340428be2a.patch
Resolves: RHEL-193559
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
The 1.16.1-8 entry was dated Fri Jun 19 2026, placing it before
the already-merged 1.16.1-7 entry dated Mon Jun 22 2026. RPM
requires descending chronological order in %changelog, causing
srpm build to fail with:
error: %changelog not in descending chronological order
Resolves: RHEL-184455
Backport upstream fix (commit f3b66928a1) for CVE-2026-52720
to gstreamer1-plugins-bad-free. The patch adds proper
framebuffer update rectangle validation in the librfb
decoder (rfbdecoder.c) by introducing clip_rectangle() and
clip_copyrect() functions, adding overflow protection for
raw encoding size calculation, and integrating bounds
checking into raw, copyrect, and fill_rectangle operations.
The patch was adapted for the standalone gst-plugins-bad
1.16.1 source layout.
CVE: CVE-2026-52720
Upstream patches:
- f3b66928a1.patch
Resolves: RHEL-184455
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit 6c146775) for CVE-2026-52722,
an integer overflow vulnerability in the VMnc decoder
(vmncdec). The patch adds a vmnc_rect_payload_size() helper
using g_size_checked_mul() for overflow-safe size computation
and adds overflow checks in vmnc_handle_wmvd_rectangle() for
CURSOR_COLOUR and CURSOR_ALPHA cursor types.
CVE: CVE-2026-52722
Upstream patches:
- 6c146775d7.patch
Resolves: RHEL-184414
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
