CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

graphics/gstreamer1-plugins-openexr 1.26.6

GStreamer OpenExr codec plugin

Port info

Maintainer
multimedia@FreeBSD.org
Packages
latest: 1.28.8, update to 1.26.6 not built yet
Upstream
up to date
Last update
to 1.28.8 via multimedia/gstreamer1-plugins · 30a7e19ff0
Quarterly
2026Q4: 1.28.8
WWW
https://gstreamer.freedesktop.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install gstreamer1-plugins-openexr
installs 1.28.8 from latest; from quarterly (2026Q4) 1.28.8
Port
# cd /usr/ports/graphics/gstreamer1-plugins-openexr && make install clean
Size
18 KiB download · 48 KiB installed
Depends on
devel/gettext-runtime 1.0_1, devel/glib20 2.88.3,2, devel/orc 0.4.44, graphics/openexr 3.4.16, misc/iso-codes 4.20.1, multimedia/gstreamer1 1.28.8_1, multimedia/gstreamer1-plugins 1.28.8, multimedia/gstreamer1-plugins-bad 1.28.8, print/freetype2 2.14.3, textproc/libxml2 2.15.4
License
LGPL20

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.28.81.28.8–
FreeBSD 151.28.81.28.8–
FreeBSD 141.28.81.28.61.28.8

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.28.81.28.8–
FreeBSD 141.28.81.28.81.28.8

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.28.8.

Fixed (7)

Show 7 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-182957.82026-08-20GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst…
CVE-2026-182967.82026-08-20GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect…
CVE-2026-182977.82026-08-20GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec…
CVE-2026-182987.82026-08-20GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect…
CVE-2026-182997.82026-08-20GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations …
CVE-2026-734336.62026-08-12A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length …
CVE-2026-734346.12026-08-12A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculat…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (33)

Jason E. Hale (jhale) · 1.26.6
GStreamer1: Update to 1.26.6

multimedia/gstreamer1-plugins-rust: Update to 0.14.2

https://gstreamer.freedesktop.org/releases/1.26/#1.26.6
31891908b9
Matthias Andree (mandree) · 1.26.5_1
*: Bump PORTREVISION of graphics/openexr users

(including those where openexr is only an option)
d6519311ed
Jason E. Hale (jhale) · 1.26.5
GStreamer1: Update to 1.26.5

Rename multimedia/gstreamer1-validate -> devel/gstreamer1-devtools and
update to 1.26.5. gst-validate has been gst-devtools since 1.17.x, but
got lost in the mix. This a development toolkit, hence the move to the
devel category.

https://gstreamer.freedesktop.org/releases/1.26/#1.26.5
2680e71d5d
Matthias Andree (mandree) · 1.26.4_1
*: Bump PORTREVISION for math/Imath update
566d74ed6b
Matthias Andree (mandree) · 1.26.4
*: strip Imath versioning

and mark py-opentimelineio as USES=python:3.11+ because versions
3.10 and older fail to package (some modules do not build).

Please everyone do test your ports with

BUILD_ALL_PYTHON_FLAVORS=       yes

in your /usr/local/etc/poudriere.d/make.conf - and

poudriere bulk -Ct -j "$JAIL" multimedia/py-opentimelineio@all

(the @all is the crucial part here)
c8ffdafdcb
Jason E. Hale (jhale)
Gstreamer: Update to 1.24.9

https://gstreamer.freedesktop.org/releases/1.24/#1.24.9

Security:	d48a2224-9b4c-11ef-bdd9-4ccc6adda413
9033cb222f
Matthias Andree (mandree)
graphics/openexr: PORTREVISION bump of openexr users due to ABI change
f3127fabc6
Jason E. Hale (jhale)
multimedia/gstreamer1: Update to 1.24.8

Mk/Uses/gstreamer.mk:
- Sort, fix whitespace issues and typos
- Promote several common variables to improve maintainer QOL
*   There's now no need to set manually set PORTVERSION nor
    SOVERSION in several Makefiles
*   This will help to prevent not updating some components
*   A note has been added, however, to remind maintainers
    to remake distinfo for certain ports
- Improve documentation

multimedia/gstreamer1-plugins-webrtc:
- New port split from multimedia/gstreamer1-plugins-bad
- multimedia/gstreamer1-plugins-rust has been updated
  to reflect this change

net/gstreamer1-plugins-sctp:
- New port split from multimedia/gstreamer1-plugins-bad

x11-toolkits/gstreamer1-plugins-qt5:
- Moved here from graphics/gstreamer1-plugins-qt to
  align with its new Qt6 counterpart

x11-toolkits/gstreamer1-plugins-qt6:
- New port: GStreamer Qt6 QML videosink plugin

*/*:
- Improve Makefile order and formatting
- Sorry for the repo churn, but not fixing this would just lead to more
  poorly formatted gstreamer ports in the future via copypasta

https://gstreamer.freedesktop.org/releases/1.24/#1.24.8

PR:		278914
Reported by:	vvd
8c1efc578d
Matthias Andree (mandree)
*: Bump PORTREVISION for OpenEXR users

Because OpenEXR's SONAME has changed with the 3.2.0 update.
New SONAME: libOpenEXR-3_2.so.31
1b4453302b
Thomas Zander (riggs)
Update gstreamer1 to upstream release 1.22.5

PR:		272141, 271505
MFH:		2023Q3
06be4e146b
Matthias Andree (mandree)
*: Bump revision of ports using math/Imath

...after its major revision update.
e434b50017
Matthias Andree (mandree)
*: Bump PORTREVISION of math/Imath users
5327591576
Thomas Zander (riggs)
Update gstreamer1 to upstream release 1.20.3

PR:		261585
Reviewed by:	riggs,jbeich,tcberner

Differential Revision:	https://reviews.freebsd.org/D36850
e3b732b479
Charlie Li (vishwin)
textproc/libxml2: bump all LIB_DEPENDS consumers

This is a separate commit to facilitate easier cherry-picking for
quarterly.

PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
d63665f7cd
Matthias Fechner (mfechner)
textproc/libxml2: bump all dependencies

This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
247c7db751
Matthias Andree (mandree)
*: graphics/openexr PORTREVISION bumps

OpenEXR changes its SONAME again, so bump PORTREVISION of its users.
56ffa089e2
Matthias Andree (mandree)
Bump portrevisions of openexr and Imath users.
1d5b7c913b
Matthias Andree (mandree)
graphics/gstreamer1-plugins-openexr: make compatible with OpenEXR/Imath 3.0
8b4cc116f6
Mathieu Arnold (mat)
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat)
Remove # $FreeBSD$ from Makefiles.
305f148f48
Matthias Andree (mandree)
graphics/openexr, ilmbase: security update to v2.5.5

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5

"Specific OSS-fuzz issues include:

    OSS-fuzz #30291 Timeout in openexr_exrcheck_fuzzer
    OSS-fuzz #29106 Heap-buffer-overflow in Imf_2_5::FastHufDecoder::decode
    OSS-fuzz #28971 Undefined-shift in Imf_2_5::cachePadding
    OSS-fuzz #29829 Integer-overflow in Imf_2_5::DwaCompressor::initializeBuffers
    OSS-fuzz #30121 Out-of-memory in openexr_exrcheck_fuzzer"

Bump PORTREVISION of ports that directly depend on openexr and/or ilmbase.

MFH:		2021Q1
Security:	98044aba-6d72-11eb-aed7-1b1b8a70cc8b
1c11b9ae32
Matthias Andree (mandree)
graphics/openexr: really commit v2.5.4 update.

Unfortunately, this was missed with the ilmbase update, and
causes yet another PORTREVISION bump on all dependent ports.

repeating ilmbase's commit log here:

"Patch release with various bug/sanitizer/security fixes, primarily related to
reading corrupted input files."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4>

Cherry-pick upstream commit for GCC 11 compatibility:
<https://github.com/AcademySoftwareFoundation/openexr/commit/a40a6151c4e746eb8f93c7c06992d0ec11289fdc>

Since this changes the patchlevel of the solibs, bump PORTREVISION of dependent
ports just to be sure.
(graphics/py-openshadinglanguage is unaltered and .includes the revision bump
from .../openshadinglanguage.)

MFH:		2021Q1 (this requires discussion by ports-secteam@!)

Reported by:	VVD (IRC, #bsdports)
c77c064297
Matthias Andree (mandree)
graphics/openexr: graphics/ilmbase: v2.5.4 update

"Patch release with various bug/sanitizer/security fixes, primarily related to
reading corrupted input files."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4>

Cherry-pick upstream commit for GCC 11 compatibility:
<https://github.com/AcademySoftwareFoundation/openexr/commit/a40a6151c4e746eb8f93c7c06992d0ec11289fdc>

Since this changes the patchlevel of the solibs, bump PORTREVISION of dependent
ports just to be sure.
(graphics/py-openshadinglanguage is unaltered and .includes the revision bump
from .../openshadinglanguage.)

MFH:		2021Q1 (this requires discussion by ports-secteam@!)
db0013e446
Matthias Andree (mandree)
graphics/ilmbase, graphics/openexr: PORTREVISION bump for users

ilmbase and openexr were updated to v2.5.3 and their shlibs changed
from *.25.0.1 to *.25.0.2.

This is a PORTREVISION bump to ports using ilmbase or openexr
to chase that change and trigger rebuild.
721533a798
Matthias Andree (mandree)
openexr/ilmbase update w/ shlib rename => PORTREVISION bumps of dependent ports

OpenEXR and ILMBASE updates to 2.5.2 rename the full shlib version
names from .0.0 to .0.1 => to be on the safe side, bump PORTREVISIONs.

Approved by:	portmgr (blanket)
MFH:		2020Q3 (PORTREVISION bump after OpenEXR/ilmbase update)
Security:	714e6c35-c75b-11ea-aa29-d74973d1f9f3
59eb5b4b37
Matthias Andree (mandree)
graphics/ilmbase: graphics/openexr: update to upstream release 2.5.1

Upstream release notes:
* A patch release that corrects the SO version for the v2.5 release,
  which missed getting bumped in v2.5.0.

* This release also fixes an improper failure in IlmImfTest
  when running on ARMv7 and AAarch64.

Bump PORTREVISION of all port directly requiring ilmbase or openexr
that are not marked BROKEN (shlib/.so file version bump).

Test build of all port directly depending on ilmbase or openexr
succeeded in poudriere in a 12.1-RELEASE amd64 jail.
38f53fd85b
Matthias Andree (mandree)
graphics/ilmbase: graphics/openexr: update to v2.5.0

ChangeLog:
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.0

* Bump PORTREVISION of all consumers except py-openimageio (BROKEN).

* cad/PrusaSlicer:
    LIB_DEPENDS: remove version from libHalf.so
    BUILD_DEPENDS+=qt5-buildtools as package (needed on bare metal builds)
    USE_GL+=gl
    USES+=pkgconfig (needed to find libHalf)
ded32047a7
Koop Mast (kwm)
Update gstreamer1 to 1.16.2.

- The spc plugin was removed inflavor for the gsm plugin.
- Added in tree qt plugin.

Changelog: https://gstreamer.freedesktop.org/releases/1.16/#1.16.2

Update net-im/fractal to 4.2.2 to support GStreamer 1.16 (approved by maintainer)

Thanks to antoine@ for the exp-run.

PR:		239386
aa49f23a6d
Piotr Kubaj (pkubaj)
graphics/gstreamer1-plugins-openexr: fix build on GCC architectures

C++11 compiler is necessary because of:
                ${REINPLACE_CMD} -e 's/c++98/c++11/' ${WRKSRC}/ext/openexr/Makefile.in
d3b27827ce
Matthias Andree (mandree)
graphics/ilmbase, graphics/openexr: upgrade to upstream v2.4.0

graphics/gstreamer1-plugins-openexr: switch from C++98 to C++11 to
match new OpenEXR headers and unbreak compilation.

Bump PORTREVISION of all ports depending directly on either, based
on assessing INDEX-12 (bump_portrevision.pl -l (shallow) used).

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0

The update was deliberately deferred until after 2020Q1, and should
not be MFH'd back to it.
2e26d3323d
Matthias Andree (mandree)
Update ilmbase and openexr to 2.3.0, rename OpenEXR to openexr.

Release notes: <https://github.com/openexr/openexr/releases/tag/v2.3.0>

Adjust LIB_DEPENDS of all ports that require ilmbase or openexr to chase
the new lower-case spelling of the name, and to omit the version from the
library name to ease future maintenance.

Bump PORTREVISION of all ports that depend on ilmbase or openexr directly,
so that they all get rebuilt on upgrades.

Add patches to graphics/ampasCTL to keep it alive, with (a) ilmbase now
that its Iex::BaseExc class is no longer derived from std::string,
details were given upstream through https://github.com/ampas/CTL/issues/71
and (b) to unwind semicolon/;-lists in cmake that stem from openexr/
ilmbase pkg-config variables.
(Note ampasCTL is unmaintained as FreeBSD port, and upstream,
and I cannot run-time test it.)

Poudriere build tests on 11.2-RELEASE-p1 amd64 of ALL ports depending
directly or indirectly on ilmbase and/or openexr have passed without
regressions.  Thus invoking due diligence, I believe I have done the
equivalent of an -exp run, and do not require approval for the dependency
chases to third-party ports.
d1cfeab07e
Matthias Andree (mandree)
Security update OpenEXR and ilmbase to 2.2.1.

While here, fix libIlmImfUtil_la_LDFLAGp so that when linking libIlmImfUtil,
the locally built libIlmImf gets precedence over the one in /usr/local,
to permit upgrades in a running system with the older version installed.

This changes the library's SONAME, so bump PORTREVISION of all dependees.

Unfortunately, this looks a bit too intrusive for an MFH to 2017Q4.

Security:	CVE-2017-9110
Security:	CVE-2017-9111
Security:	CVE-2017-9112
Security:	CVE-2017-9113
Security:	CVE-2017-9114
Security:	CVE-2017-9115
Security:	CVE-2017-9116
Security:	803879e9-4195-11e7-9b08-080027ef73ec
1fb0ae7cf9
Koop Mast (kwm)
Update GStreamer1 ports to 1.12.2.

Rework the adding of dependancies in Mk/bsd.gstreamer.mk.
Previous when using USE_GSTREAMER[1] it would just add the request modules to BUILD/RUN_DEPENDS. This caused the qa script to complain because the old code didn't implicit depend on the gstreamer1 and gstreamer1-plugins[-bad] ports for the libraries they carried, even if they where present via the plugins! The new code adds implicit depends on these ports so USE_GSTREAMER[1] using ports have all the libraries included.

* The mad mp3 plugin was removed, mpg123 plugin also provides mp3 decoding. Switch over ports that used the gstreamer1 mad plugin.
* gtksink plugin renamed -> gtk
* Hook up the sndio plugin into the framework
* Add some indirect dependacies where needed
* Reorder the plugin list in bsd.gstreamer.mk so only one plugin per line. When changing plugins it doesn't result in multiple lines being changed.
* Remove mentions in bsd.gstreamer.mk of plugins mentions that where removed.
* Depend on libunwind on i386/amd64, GStreamer links to it if it is present.

PR:		220753
Exp-run by:	antoine@
d566d54fa6