Version in base suite: 1.26.2-3+deb13u2 Base version: gst-plugins-bad1.0_1.26.2-3+deb13u2 Target version: gst-plugins-bad1.0_1.26.2-3+deb13u3 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gst-plugins-bad1.0/gst-plugins-bad1.0_1.26.2-3+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gst-plugins-bad1.0/gst-plugins-bad1.0_1.26.2-3+deb13u3.dsc changelog | 10 + patches/CVE-2026-12891.patch | 23 ++++ patches/CVE-2026-12892.patch | 17 +++ patches/CVE-2026-19387.patch | 32 ++++++ patches/CVE-2026-52720.patch | 223 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-52722.patch | 87 ++++++++++++++++ patches/series | 5 7 files changed, 397 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo7uytsr9/gst-plugins-bad1.0_1.26.2-3+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo7uytsr9/gst-plugins-bad1.0_1.26.2-3+deb13u3.dsc: no acceptable signature found diff -Nru gst-plugins-bad1.0-1.26.2/debian/changelog gst-plugins-bad1.0-1.26.2/debian/changelog --- gst-plugins-bad1.0-1.26.2/debian/changelog 2026-06-21 17:35:19.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/changelog 2026-08-14 15:49:42.000000000 +0000 @@ -1,3 +1,13 @@ +gst-plugins-bad1.0 (1.26.2-3+deb13u3) trixie-security; urgency=medium + + * CVE-2026-19387 + * CVE-2026-52722 + * CVE-2026-52720 + * CVE-2026-12892 + * CVE-2026-12891 + + -- Moritz Mühlenhoff Fri, 14 Aug 2026 17:49:42 +0200 + gst-plugins-bad1.0 (1.26.2-3+deb13u2) trixie-security; urgency=medium * CVE-2026-52718 diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12891.patch gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12891.patch --- gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12891.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12891.patch 2026-08-14 15:49:38.000000000 +0000 @@ -0,0 +1,23 @@ +From dbf50dce3154ec4aa9d3858110761f3479a0f002 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Wed, 17 Jun 2026 10:03:36 +0300 +Subject: [PATCH] h266parser: Check aspect ratio index against lookup table + length + +--- gst-plugins-bad1.0-1.26.2.orig/gst-libs/gst/codecparsers/gsth266parser.c ++++ gst-plugins-bad1.0-1.26.2/gst-libs/gst/codecparsers/gsth266parser.c +@@ -486,9 +486,13 @@ gst_h266_parse_vui_parameters (GstH266VU + READ_UINT16 (nr, vui->sar_height, 16); + vui->par_n = vui->sar_width; + vui->par_d = vui->sar_height; +- } else { ++ } else if (vui->aspect_ratio_idc <= 16) { + vui->par_n = aspect_ratios[vui->aspect_ratio_idc].par_n; + vui->par_d = aspect_ratios[vui->aspect_ratio_idc].par_d; ++ } else { ++ GST_WARNING ("Invalid bitstream: aspect_ratio_idc set " ++ "to value %d (must be 0-16 or %d)", ++ vui->aspect_ratio_idc, EXTENDED_SAR); + } + } else { + vui->aspect_ratio_constant_flag = 0; diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12892.patch gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12892.patch --- gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12892.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-12892.patch 2026-08-14 15:48:34.000000000 +0000 @@ -0,0 +1,17 @@ +From dfd0be05499d3315b0d125b3be5f06f7ace52259 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 16 Jun 2026 15:23:13 +0300 +Subject: [PATCH] h264parse: Check for enough slice header data being available + +--- gst-plugins-bad1.0-1.26.2.orig/gst/videoparsers/gsth264parse.c ++++ gst-plugins-bad1.0-1.26.2/gst/videoparsers/gsth264parse.c +@@ -1105,7 +1105,8 @@ gst_h264_parse_process_nal (GstH264Parse + h264parse->picture_start = TRUE; + + /* don't need to parse the whole slice (header) here */ +- if (*(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) { ++ if (nalu->size > nalu->header_bytes && ++ *(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) { + /* means first_mb_in_slice == 0 */ + /* real frame data */ + GST_DEBUG_OBJECT (h264parse, "first_mb_in_slice = 0"); diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-19387.patch gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-19387.patch --- gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-19387.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-19387.patch 2026-08-14 15:42:26.000000000 +0000 @@ -0,0 +1,32 @@ +From 13c6808221f57dd9be49377085ea8056f3a69e39 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Mon, 3 Aug 2026 12:30:30 +0300 +Subject: [PATCH] adpcmdec: Fail negotiation if block_align is not provided + +From dbc19dcbb0d16484ec77e8ba1ec590b71d286570 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Mon, 3 Aug 2026 12:30:45 +0300 +Subject: [PATCH] adpcmdec: Fix IMA ADPCM input size check to match with the + actual code + + +--- gst-plugins-bad1.0-1.26.2.orig/gst/adpcmdec/adpcmdec.c ++++ gst-plugins-bad1.0-1.26.2/gst/adpcmdec/adpcmdec.c +@@ -108,7 +108,7 @@ adpcmdec_set_format (GstAudioDecoder * b + return FALSE; + + if (!gst_structure_get_int (structure, "block_align", &dec->blocksize)) +- dec->blocksize = -1; /* Not provided */ ++ return FALSE; + + if (!gst_structure_get_int (structure, "rate", &dec->rate)) + return FALSE; +@@ -280,7 +280,7 @@ adpcmdec_decode_ima_block (ADPCMDec * de + int i, j; + int sample; + +- if ((n_samples - dec->channels) % 8 != 0) { ++ if ((n_samples - dec->channels) % (8 * dec->channels) != 0) { + GST_WARNING_OBJECT (dec, "Input not correct size"); + return FALSE; + } diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52720.patch gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52720.patch --- gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52720.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52720.patch 2026-08-14 15:47:19.000000000 +0000 @@ -0,0 +1,223 @@ +From 1ca88138fb0f8562861956b66a0c98406bcb7370 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Sun, 14 Jun 2026 22:03:25 +0300 +Subject: [PATCH] librfb: Validate framebuffer update rectangles against the + framebuffer size + +--- gst-plugins-bad1.0-1.26.2.orig/gst/librfb/rfbdecoder.c ++++ gst-plugins-bad1.0-1.26.2/gst/librfb/rfbdecoder.c +@@ -45,6 +45,10 @@ static gboolean rfb_decoder_corre_encodi + gint start_y, gint rect_w, gint rect_h); + static gboolean rfb_decoder_hextile_encoding (RfbDecoder * decoder, + gint start_x, gint start_y, gint rect_w, gint rect_h); ++static gboolean rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x, ++ gint * y, gint * w, gint * h, gint * skip_x, gint * skip_y); ++static gboolean rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x, ++ gint * dst_y, gint * src_x, gint * src_y, gint * w, gint * h); + + RfbDecoder * + rfb_decoder_new (void) +@@ -802,23 +806,20 @@ rfb_decoder_state_framebuffer_update_rec + if (!rfb_decoder_read (decoder, 12)) + return FALSE; + +- x = RFB_GET_UINT16 (decoder->data + 0) - decoder->offset_x; +- y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y; ++ x = RFB_GET_UINT16 (decoder->data + 0); ++ y = RFB_GET_UINT16 (decoder->data + 2); + w = RFB_GET_UINT16 (decoder->data + 4); + h = RFB_GET_UINT16 (decoder->data + 6); + encoding = RFB_GET_UINT32 (decoder->data + 8); + ++ x -= (gint) decoder->offset_x; ++ y -= (gint) decoder->offset_y; ++ + GST_DEBUG ("update received"); + GST_DEBUG ("x:%d y:%d", x, y); + GST_DEBUG ("w:%d h:%d", w, h); + GST_DEBUG ("encoding: %d", encoding); + +- if (((w * h) + (x * y)) > (decoder->width * decoder->height)) { +- GST_ERROR ("Desktop resize is unsupported."); +- decoder->state = NULL; +- return TRUE; +- } +- + switch (encoding) { + case ENCODING_TYPE_RAW: + ret = rfb_decoder_raw_encoding (decoder, x, y, w, h); +@@ -857,11 +858,20 @@ static gboolean + rfb_decoder_raw_encoding (RfbDecoder * decoder, gint start_x, gint start_y, + gint rect_w, gint rect_h) + { +- gint size; ++ gint copy_x, copy_y, copy_w, copy_h; ++ gint skip_x = 0, skip_y = 0; ++ guint32 size; + guint8 *frame, *p; + guint32 raw_line_size; ++ guint32 copy_line_size; ++ ++ if (rect_w <= 0 || rect_h <= 0) ++ return TRUE; + + raw_line_size = rect_w * decoder->bytespp; ++ if (rect_h > 0 && raw_line_size > G_MAXUINT32 / rect_h) ++ return FALSE; ++ + size = rect_h * raw_line_size; + + GST_DEBUG ("Reading %d bytes (%dx%d)", size, rect_w, rect_h); +@@ -869,13 +879,23 @@ rfb_decoder_raw_encoding (RfbDecoder * d + if (!rfb_decoder_read (decoder, size)) + return FALSE; + ++ copy_x = start_x; ++ copy_y = start_y; ++ copy_w = rect_w; ++ copy_h = rect_h; ++ ++ if (!rfb_decoder_clip_rectangle (decoder, ©_x, ©_y, ©_w, ©_h, ++ &skip_x, &skip_y)) ++ return TRUE; ++ + frame = +- decoder->frame + (((start_y * decoder->rect_width) + +- start_x) * decoder->bytespp); +- p = decoder->data; ++ decoder->frame + (((copy_y * decoder->rect_width) + ++ copy_x) * decoder->bytespp); ++ p = decoder->data + (skip_y * raw_line_size) + (skip_x * decoder->bytespp); ++ copy_line_size = copy_w * decoder->bytespp; + +- while (rect_h--) { +- memcpy (frame, p, raw_line_size); ++ while (copy_h--) { ++ memcpy (frame, p, copy_line_size); + p += raw_line_size; + frame += decoder->line_size; + } +@@ -887,7 +907,8 @@ static gboolean + rfb_decoder_copyrect_encoding (RfbDecoder * decoder, gint start_x, gint start_y, + gint rect_w, gint rect_h) + { +- guint16 src_x, src_y; ++ gint src_x, src_y; ++ gint copy_x, copy_y, copy_w, copy_h; + gint line_width, copyrect_width; + guint8 *src, *dst; + +@@ -895,20 +916,28 @@ rfb_decoder_copyrect_encoding (RfbDecode + return FALSE; + + /* don't forget the offset */ +- src_x = RFB_GET_UINT16 (decoder->data) - decoder->offset_x; +- src_y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y; ++ src_x = RFB_GET_UINT16 (decoder->data) - (gint) decoder->offset_x; ++ src_y = RFB_GET_UINT16 (decoder->data + 2) - (gint) decoder->offset_y; + GST_DEBUG ("Copyrect from %d %d", src_x, src_y); + +- copyrect_width = rect_w * decoder->bytespp; ++ copy_x = start_x; ++ copy_y = start_y; ++ copy_w = rect_w; ++ copy_h = rect_h; ++ if (!rfb_decoder_clip_copyrect (decoder, ©_x, ©_y, &src_x, &src_y, ++ ©_w, ©_h)) ++ return TRUE; ++ ++ copyrect_width = copy_w * decoder->bytespp; + line_width = decoder->line_size; + src = + decoder->prev_frame + ((src_y * decoder->rect_width) + + src_x) * decoder->bytespp; + dst = +- decoder->frame + ((start_y * decoder->rect_width) + +- start_x) * decoder->bytespp; ++ decoder->frame + ((copy_y * decoder->rect_width) + ++ copy_x) * decoder->bytespp; + +- while (rect_h--) { ++ while (copy_h--) { + memcpy (dst, src, copyrect_width); + src += line_width; + dst += line_width; +@@ -926,6 +955,9 @@ rfb_decoder_fill_rectangle (RfbDecoder * + guint32 *offset; + gint i, j; + ++ if (!rfb_decoder_clip_rectangle (decoder, &x, &y, &w, &h, NULL, NULL)) ++ return; ++ + for (i = 0; i < h; i++) { + offset = + (guint32 *) (decoder->frame + ((x + (y + +@@ -1100,6 +1132,68 @@ rfb_decoder_hextile_encoding (RfbDecoder + + return TRUE; + } ++ ++static gboolean ++rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x, gint * y, gint * w, ++ gint * h, gint * skip_x, gint * skip_y) ++{ ++ gint x1, y1, x2, y2; ++ gint orig_x, orig_y; ++ ++ if (*w <= 0 || *h <= 0) ++ return FALSE; ++ ++ orig_x = *x; ++ orig_y = *y; ++ x1 = MAX (orig_x, 0); ++ y1 = MAX (orig_y, 0); ++ x2 = MIN (orig_x + *w, (gint) decoder->rect_width); ++ y2 = MIN (orig_y + *h, (gint) decoder->rect_height); ++ ++ if (x2 <= x1 || y2 <= y1) ++ return FALSE; ++ ++ *x = x1; ++ *y = y1; ++ *w = x2 - x1; ++ *h = y2 - y1; ++ ++ if (skip_x) ++ *skip_x = x1 - orig_x; ++ if (skip_y) ++ *skip_y = y1 - orig_y; ++ ++ return TRUE; ++} ++ ++static gboolean ++rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x, gint * dst_y, ++ gint * src_x, gint * src_y, gint * w, gint * h) ++{ ++ gint left, top, right, bottom; ++ ++ if (*w <= 0 || *h <= 0) ++ return FALSE; ++ ++ left = MAX (0, MAX (-*dst_x, -*src_x)); ++ top = MAX (0, MAX (-*dst_y, -*src_y)); ++ right = MIN (*w, MIN ((gint) decoder->rect_width - *dst_x, ++ (gint) decoder->rect_width - *src_x)); ++ bottom = MIN (*h, MIN ((gint) decoder->rect_height - *dst_y, ++ (gint) decoder->rect_height - *src_y)); ++ ++ if (right <= left || bottom <= top) ++ return FALSE; ++ ++ *dst_x += left; ++ *dst_y += top; ++ *src_x += left; ++ *src_y += top; ++ *w = right - left; ++ *h = bottom - top; ++ ++ return TRUE; ++} + + static gboolean + rfb_decoder_state_set_colour_map_entries (RfbDecoder * decoder) diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52722.patch gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52722.patch --- gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52722.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/CVE-2026-52722.patch 2026-08-14 15:45:35.000000000 +0000 @@ -0,0 +1,87 @@ +From d30966b87f3a1358b01ec404607f6c9b2f10e9f7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 16 Jun 2026 10:30:54 +0300 +Subject: [PATCH] vnmdec: Avoid integer overflows when rectangle positions and + sizes + +--- gst-plugins-bad1.0-1.26.2.orig/gst/vmnc/vmncdec.c ++++ gst-plugins-bad1.0-1.26.2/gst/vmnc/vmncdec.c +@@ -155,6 +155,20 @@ struct RfbRectangle + typedef int (*rectangle_handler) (GstVMncDec * dec, struct RfbRectangle * rect, + const guint8 * data, int len, gboolean decode); + ++static gboolean ++vmnc_rect_payload_size (struct RfbRectangle *rect, guint bytes_per_pixel, ++ gsize * size) ++{ ++ gsize pixels; ++ ++ if (!g_size_checked_mul (&pixels, rect->width, rect->height)) ++ return FALSE; ++ if (!g_size_checked_mul (size, pixels, bytes_per_pixel)) ++ return FALSE; ++ ++ return TRUE; ++} ++ + static int + vmnc_handle_wmvi_rectangle (GstVMncDec * dec, struct RfbRectangle *rect, + const guint8 * data, int len, gboolean decode) +@@ -395,7 +409,8 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * + { + /* Cursor data. */ + int datalen = 2; +- int type, size; ++ int type; ++ gsize size; + + if (len < datalen) { + GST_LOG_OBJECT (dec, "Cursor data too short"); +@@ -405,9 +420,19 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * + type = RFB_GET_UINT8 (data); + + if (type == CURSOR_COLOUR) { +- datalen += rect->width * rect->height * dec->format.bytes_per_pixel * 2; ++ if (!vmnc_rect_payload_size (rect, dec->format.bytes_per_pixel, &size) || ++ size > ((gsize) G_MAXINT - datalen) / 2) { ++ GST_WARNING_OBJECT (dec, "Cursor data size overflow"); ++ return ERROR_INVALID; ++ } ++ datalen += size * 2; + } else if (type == CURSOR_ALPHA) { +- datalen += rect->width * rect->height * 4; ++ if (!vmnc_rect_payload_size (rect, 4, &size) || ++ size > (gsize) G_MAXINT - datalen) { ++ GST_WARNING_OBJECT (dec, "Cursor data size overflow"); ++ return ERROR_INVALID; ++ } ++ datalen += size; + } else { + GST_WARNING_OBJECT (dec, "Unknown cursor type: %d", type); + return ERROR_INVALID; +@@ -422,22 +447,20 @@ vmnc_handle_wmvd_rectangle (GstVMncDec * + dec->cursor.type = type; + dec->cursor.width = rect->width; + dec->cursor.height = rect->height; +- dec->cursor.type = type; + dec->cursor.hot_x = rect->x; + dec->cursor.hot_y = rect->y; + + g_free (dec->cursor.cursordata); + g_free (dec->cursor.cursormask); + +- if (type == 0) { +- size = rect->width * rect->height * dec->format.bytes_per_pixel; ++ if (type == CURSOR_COLOUR) { + dec->cursor.cursordata = g_malloc (size); + dec->cursor.cursormask = g_malloc (size); + memcpy (dec->cursor.cursordata, data + 2, size); + memcpy (dec->cursor.cursormask, data + 2 + size, size); + } else { +- dec->cursor.cursordata = g_malloc (rect->width * rect->height * 4); +- memcpy (dec->cursor.cursordata, data + 2, rect->width * rect->height * 4); ++ dec->cursor.cursordata = g_malloc (size); ++ memcpy (dec->cursor.cursordata, data + 2, size); + } + + return datalen; diff -Nru gst-plugins-bad1.0-1.26.2/debian/patches/series gst-plugins-bad1.0-1.26.2/debian/patches/series --- gst-plugins-bad1.0-1.26.2/debian/patches/series 2026-06-21 17:35:04.000000000 +0000 +++ gst-plugins-bad1.0-1.26.2/debian/patches/series 2026-08-14 15:49:27.000000000 +0000 @@ -9,3 +9,8 @@ CVE-2026-52718.patch CVE-2026-52719.patch CVE-2026-53701.patch +CVE-2026-19387.patch +CVE-2026-52722.patch +CVE-2026-52720.patch +CVE-2026-12892.patch +CVE-2026-12891.patch