[El-errata] ELSA-2026-36834 Important: Oracle Linux 9 gstreamer1-plugins-bad-free security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-36834

http://linux.oracle.com/errata/ELSA-2026-36834.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.i686.rpm
gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.x86_64.rpm
gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.i686.rpm
gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.x86_64.rpm
gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.i686.rpm
gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.x86_64.rpm

aarch64:
gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.aarch64.rpm
gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.aarch64.rpm
gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.src.rpm

Related CVEs:

CVE-2026-52718
CVE-2026-52719
CVE-2026-52720
CVE-2026-52722




Description of changes:

[1.22.12-7.1]
- Sync with c9s release -5..-7: fix for CVE-2026-2923, CVE-2026-3082
  in dvbsuboverlay and jpegparser
  Resolves: RHEL-156242, RHEL-156255

[1.22.12-4.4]
- Fix bytes/bits confusion in AV1 tile data size parsing
  (CVE-2026-52718)
  Resolves: RHEL-184388

[1.22.12-4.3]
- Fix for CVE-2026-52719: vajpegdecoder out-of-bounds read
  Resolves: RHEL-184403

[1.22.12-4.2]
- Fix integer overflows in vmnc decoder (CVE-2026-52722)
  Resolves: RHEL-184422

[1.22.12-4.1]
- Fix for CVE-2026-52720: validate framebuffer update rectangles
  in librfb plugin
  Resolves: RHEL-184459

[1.22.12-4]
- fix for CVE-2025-3887
  Resolves: RHEL-93059

[1.22.12-3]
- Rebuild
- Resolves: RHEL-38511, RHEL-41157

[1.22.12-2]
- Rebuild
- Resolves: RHEL-38511, RHEL-41157