ALAS2-2026-3328

Amazon Linux 2 Security Advisory: ALAS2-2026-3328
Advisory Released Date: 2026-06-08
Advisory Updated Date: 2026-06-08
Severity: Medium
Issue Overview:

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero. (CVE-2026-46469)

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero. (CVE-2026-46470)


Affected Packages:

gstreamer1-plugins-good


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update gstreamer1-plugins-good or yum update --advisory ALAS2-2026-3328 to update your system.

New Packages:
aarch64:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.11.aarch64
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.11.aarch64
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.11.aarch64

i686:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.11.i686
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.11.i686
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.11.i686

src:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.11.src

x86_64:
    gstreamer1-plugins-good-1.18.4-6.amzn2.0.11.x86_64
    gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.11.x86_64
    gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.11.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-46469, CVE-2026-46470

Mitre: CVE-2026-46469, CVE-2026-46470