A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the man...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Ubuntu:Pro:16.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:Pro:18.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:Pro:20.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:22.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:24.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:26.10gst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
| Ubuntu:26.04:LTSgst-plugins-good1.0 |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report gstreamer.freedesktop.org
- report gitlab.freedesktop.org
- report access.redhat.com
- report access.redhat.com
- report access.redhat.com
- report bugzilla.redhat.com
- report gitlab.freedesktop.org