Ubuntu USN-8798-1 Fixes GStreamer Good Plugins Vulnerabilities
Tech GuruQuick Answer
Ubuntu USN-8798-1 fixes four vulnerabilities in GStreamer Good Plugins. Crafted MRF or PNG content and RTP packets can trigger memory-handling errors, with possible application crashes or code execution. Apply the Good Plugins update for the installed Ubuntu release.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory installed Good Plugins binaries and their consuming media or streaming applications, then update from the supported repository for that Ubuntu codename.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GStreamer Good Plugins packages on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial) |
|---|---|
| Advisory | USN-8798-1 |
| CVEs | CVE-2026-18295, CVE-2026-18296, CVE-2026-18298, CVE-2026-18299 |
| Authoritative release date | 2026-09-21 (Canonical publication date; no time specified) |
| Authority revision date | No separate revision timestamp verified in the public USN; the former precise imported time was not established as an advisory revision. |
| Affected versions | The Ubuntu releases and packages enumerated in USN-8798-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial). |
| Fixed version | bionic: gst-plugins-good1.0 1.14.5-0ubuntu1~18.04.3+esm3 / focal: gst-plugins-good1.0 1.16.3-0ubuntu1.3+esm3 / jammy: gst-plugins-good1.0 1.20.3-0ubuntu1.9 / noble: gst-plugins-good1.0 1.24.2-1ubuntu1.7 / resolute: gst-plugins-good1.0 1.28.2-2ubuntu0.3 / xenial: gst-plugins-good1.0 1.8.3-1ubuntu0.5+esm3 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | USN-8798-1 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
CVE-2026-18295 and CVE-2026-18296 concern MRF parsing, CVE-2026-18298 concerns PNG parsing, and CVE-2026-18299 concerns RTP processing. The source-package name gst-plugins-good1.0 groups installed binaries such as gstreamer1.0-plugins-good and the GTK, PulseAudio or Qt plugins listed for that release.
What To Validate Now
- Inventory. Locate applications and services using GStreamer Good Plugins, including RTP consumers; record the Ubuntu release and installed plugin binaries.
- Establish applicability. Match installed binaries to USN-8798-1. Ubuntu 16.04 fixes require Ubuntu Pro with the Legacy Support add-on; Ubuntu 18.04 and 20.04 fixes are listed under Ubuntu Pro.
- Remediate. Apply the standard system update to affected installed binaries using the release-specific versions in the table. Do not substitute Base Plugins packages or another Ubuntu release's build.
- Validate. Confirm installed package versions and restart affected media processes as appropriate. Exercise representative image/media playback and any RTP streaming path in use; updating Good Plugins is not proof that the separate Base Plugins update is installed.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
