Backport upstream commit 6c146775d784 to fix integer
overflows in the vmnc decoder when computing rectangle
positions and sizes (CVE-2026-52722). The patch adds
overflow-safe size computation using g_size_checked_mul()
for cursor data allocations in both CURSOR_COLOUR and
CURSOR_ALPHA code paths.
CVE: CVE-2026-52722
Upstream patches:
- 6c146775d7.patch
Resolves: RHEL-184427
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-59692 which addresses a
buffer allocation issue in the DTLS connection handling. The
peer certificate subject DN was written into a fixed 2048-byte
stack buffer which could be too small. The fix dynamically
allocates a correctly sized buffer and adds proper error
handling for the BIO_read call.
CVE: CVE-2026-59692
Upstream patches:
- 945e139f8f.patch
Resolves: RHEL-193566
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-59691 from upstream MR 12054 to
address incorrect bytes-per-pixel handling in the rfbsrc
plugin's RFB decoder. The patch fixes rfb_decoder_fill_rectangle()
to use the correct bpp when copying hextile data, and adds a
new rfb_decoder_get_pixel() helper to read the correct number
of bytes for color values in RRE, CoRRE, and hextile encodings.
CVE: CVE-2026-59691
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12054.patch
Resolves: RHEL-193549
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 1ca88138fb0f to fix CVE-2026-52720
in the librfb plugin. The patch adds validation for
framebuffer update rectangles against the framebuffer size
in rfbdecoder.c, preventing potential out-of-bounds access.
CVE: CVE-2026-52720
Upstream patches:
- 1ca88138fb.patch
Resolves: RHEL-184463
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Previously, the whole contents of this package used to be part of the
openh264 srpm, which was used to build both the openh264 library and the
gstreamer openh264 plugin. All of which was built in koji, but hosted by
Cisco on their servers.
Now with the introduction of the "noopenh264" stub package in Fedora,
we'll be able to build the gstreamer plugin as part of
gstreamer1-plugins-bad-free again. The stub is used during build
time, and gets replaced by the actual openh264 library package that's
downloaded directly from Cisco on actual user systems.
The binary package name used to be gstreamer1-plugin-openh264 and this
commit keeps the exact same package name, so no obsoletes are needed.
