CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

multimedia/gstreamer1-plugins-ugly 1.28.3

GStreamer-plugins set of good-quality plug-ins that might have distribution problems

Port info

Maintainer
multimedia@FreeBSD.org
Packages
latest: 1.28.8, update to 1.28.3 not built yet
Upstream
up to date
Last update
to 1.28.8 via multimedia/gstreamer1-plugins · 30a7e19ff0
Quarterly
2026Q4: 1.28.8
WWW
https://gstreamer.freedesktop.org/
Links
cgit · VuXML

Install

Package
# pkg install gstreamer1-plugins-ugly
installs 1.28.8 from latest; from quarterly (2026Q4) 1.28.8
Port
# cd /usr/ports/multimedia/gstreamer1-plugins-ugly && make install clean
Size
124 KiB download · 362 KiB installed
Depends on
devel/gettext-runtime 1.0_1, devel/glib20 2.88.3,2, devel/orc 0.4.44, misc/iso-codes 4.20.1, multimedia/gstreamer1 1.28.8_1, multimedia/gstreamer1-plugins 1.28.8, print/freetype2 2.14.3, textproc/libxml2 2.15.4
License
LGPL20

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.28.81.28.8–
FreeBSD 151.28.81.28.8–
FreeBSD 141.28.81.28.61.28.8

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.28.81.28.8–
FreeBSD 141.28.81.28.81.28.8

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.28.8.

Fixed (14)

Show 14 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-182957.82026-08-20GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst…
CVE-2026-182967.82026-08-20GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect…
CVE-2026-182977.82026-08-20GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec…
CVE-2026-182987.82026-08-20GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect…
CVE-2026-182997.82026-08-20GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations …
CVE-2026-734336.62026-08-12A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length …
CVE-2026-734346.12026-08-12A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculat…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (27)

Jason E. Hale (jhale) · 1.28.3
GStreamer1: Update to 1.28.3

multimedia/gstreamer1-plugins-rust: Update to 0.15.2

Changes:
https://gstreamer.freedesktop.org/releases/1.28/#1.28.2
https://gstreamer.freedesktop.org/releases/1.28/#1.28.3

MFH:		2026Q2
Security:	05aadfcc-55f5-11f1-915c-8974b59277b5,
		ea4c5b9d-55f7-11f1-915c-8974b59277b5
1d35c6d802
Jason E. Hale (jhale) · 1.28.0
GStreamer1: Update to 1.28.0

The y4menc (previously from good) and y4mdec (previously from bad)
plugins have been consolidated into y4m (now from good).

The vaapi component (multimedia/gstreamer1-vaapi) is no longer supplied
by upstream and will be removed after 2026Q1. This has been superseded by
the va plugin from 'bad', which we don't have and is rather Linux-heavy,
but no ports seem to use this anyways. Remove from makesum-all target
and adjust to be static 1.26.10 (last available) version.

Add svtav1 component to gstreamer.mk after f96400339bd6. [1]

multimedia/gstreamer1-plugins-svt-hevc has been marked DEPRECATED since
multimedia/svt-hevc is marked DEPRECATED and will be removed after
2026Q1. [1] This port does not seem to be used anywhere in the ports
tree.

Note for local patching: meson_options.txt was renamed by upstream to
meson.options across the board [2] and this change adapts to that.

Changes:
https://gstreamer.freedesktop.org/releases/1.28/

[2] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/128710caab3e7521384c4c82df031702f1728af8

PR:		292706 [1]
Reported by:	jbeich [1]
c11c91c602
Jason E. Hale (jhale) · 1.26.0
GStreamer: Update to 1.26.0

https://gstreamer.freedesktop.org/releases/1.26/
1ba9b3ba5b
Jason E. Hale (jhale)
multimedia/gstreamer1: Update to 1.24.8

Mk/Uses/gstreamer.mk:
- Sort, fix whitespace issues and typos
- Promote several common variables to improve maintainer QOL
*   There's now no need to set manually set PORTVERSION nor
    SOVERSION in several Makefiles
*   This will help to prevent not updating some components
*   A note has been added, however, to remind maintainers
    to remake distinfo for certain ports
- Improve documentation

multimedia/gstreamer1-plugins-webrtc:
- New port split from multimedia/gstreamer1-plugins-bad
- multimedia/gstreamer1-plugins-rust has been updated
  to reflect this change

net/gstreamer1-plugins-sctp:
- New port split from multimedia/gstreamer1-plugins-bad

x11-toolkits/gstreamer1-plugins-qt5:
- Moved here from graphics/gstreamer1-plugins-qt to
  align with its new Qt6 counterpart

x11-toolkits/gstreamer1-plugins-qt6:
- New port: GStreamer Qt6 QML videosink plugin

*/*:
- Improve Makefile order and formatting
- Sorry for the repo churn, but not fixing this would just lead to more
  poorly formatted gstreamer ports in the future via copypasta

https://gstreamer.freedesktop.org/releases/1.24/#1.24.8

PR:		278914
Reported by:	vvd
8c1efc578d
Gleb Popov (arrowd)
multimedia/gstreamer1: Update to 1.22, new stable branch.

PR:		269895
Exp-run by:	antoine
Sponsored by:   Serenity Cybersecurity, LLC
4a8a17c8c6
Gleb Popov (arrowd)
multimedia/gstreamer1: Update to 1.20.6

Sponsored by:	Serenity Cybersecurity, LLC
88a2a7b867
Thomas Zander (riggs)
Update gstreamer1 to upstream release 1.20.3

PR:		261585
Reviewed by:	riggs,jbeich,tcberner

Differential Revision:	https://reviews.freebsd.org/D36850
e3b732b479
Tobias C. Berner (tcberner)
multimedia: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron LI <aly@aaronly.me>
  *  Alexander Botero-Lowry <alexbl@FreeBSD.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrew Thompson <andy@fud.org.nz>
  *  Andrew Thompson <thompsa@FreeBSD.org>
  *  Angel Carpintero <ack@telefonica.net>
  *  Anish Mistry (with help from mean)
  *  Anonymous <swell.k@gmail.com>
  *  Ashish SHUKLA <ashish@FreeBSD.org>
  *  Ashish Shukla <wahjava@gmail.com>
  *  Ben Woods <woodsb02@FreeBSD.org>
  *  Brian Somers <brian@FreeBSD.org>
  *  Bruce M Simpson <bms@FreeBSD.org>
  *  Byung-Hee HWANG <bh@izb.knu.ac.kr>
  *  Charlie Kester <corky1951@comcast.net>
  *  Chess Griffin <chess@chessgriffin.com>
  *  Chris Piazza <cpiazza@FreeBSD.org>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Chuck Hein <chein@FreeBSD.org> & Jim Overholt <overholt@isdw.net>
  *  Daniel Morante <daniel@morante.net>
  *  Diego Depaoli <trebestie@gmail.com> and Yinghong Liu <relaxbsd@gmail.com>
  *  Dierk Sacher <dierk@blaxxtarz.de>
  *  Dreamcat4 <dreamcat4@gmail.com>
  *  Earl Gay <earl@eeg3.net>
  *  Ed Schouten <ed@FreeBSD.org>
  *  Edwin Groothuis <edwin@mavetju.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Felix Palmen <felix@palmen-it.de>
  *  Franz Bettag <franz@bett.ag>
  *  FreeBSD GNOME Team <gnome@freebsd.org>
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Grzegorz Blach <gblach@FreeBSD.org>
  *  Gustau Perez <gustau.perez@gmail.com>
  *  Harold Gutch <logix@foobar.franken.de>
  *  Heiner <h.eichmann@gmx.de>
  *  Heiner Eichmann <h.eichmann@gmx.de>
  *  Hendrik Scholz <hendrik@scholz.net>
  *  Herbert J. Skuhra <h.skuhra@gmail.com>
  *  Herve Quiroz <hq@FreeBSD.org>
  *  Holger Lamm
  *  J.R. Oldroyd <fbsd@opal.com>
  *  Jason Harmening <jason.harmening@gmail.com>
  *  Jille Timmermans (jille@quis.cx)
  *  Juergen Lock <nox@FreeBSD.org>
  *  Juergen Lock <nox@jelal.kn-bremen.de>
  *  KalleDK <plexmaintainer@k-moeller.dk>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Koop Mast <kwm@rainbow-runner.nl>
  *  Kozlov Sergey <kozlov.sergey.404@gmail.com>
  *  Kris Moore
  *  Kuan-Chung Chiu <buganini@gmail.com>
  *  Lars Eggert <lars.eggert@gmx.net>
  *  Leinier Cruz Salfran <salfrancl@yahoo.es>
  *  MANTANI Nobutaka <nobutaka@nobutaka.com>
  *  Manuel Creach <manuel.creach@icloud.com>
  *  Marc van Woerkom <3d@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Neubauer <m.ne@gmx.net>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Michael Johnson <ahze@FreeBSD.org>
  *  Michael Johnson <ahze@ahze.net>
  *  Michael Nottebrock <michaelnottebrock@gmx.net>
  *  Michael Nottebrock <michaelnottebrock@gmx.net> et al
  *  Mina Naguib <webmaster@topfx.com>
  *  Mykola Dzham <i@levsha.me>
  *  Naram Qashat <cyberbotx@cyberbotx.com>
  *  Olivier Cochard-Labbe <olivier@FreeBSD.org>
  *  Pascal Vizeli <pvizeli@yahoo.de>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Pawel Pekala <pawel@FreeBSD.org>
  *  Petar Zhivkov Petrov <pesho.petrov@gmail.com>
  *  Phil Oleson
  *  Phil Oleson <oz@nixil.net>
  *  Piotr Kubaj <pkubaj@anongoth.pl>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Raaf <freebsd@luna.afraid.org>
  *  Randall Hopper <aa8vb@nc.rr.com>
  *  Rodrigo OSORIO <rodrigo@FreeBSD.org>
  *  Rozhuk Ivan 2018 <rozhuk.im@gmail.com>
  *  Rozhuk Ivan <rozhuk.im@gmail.com>
  *  Rozhuk Ivan rozhuk.im@gmail.com
  *  Rusmir Dusko <nemysis@FreeBSD.org>
  *  Stacey Son <mythdev@son.org>, Ari Maniatis <ari@ish.com.au>
  *  Steve Wills <steve@mouf.net>
  *  Steve Wills <swills@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas E. Zander
  *  Thomas E. Zander with help from Vladimir Kushnir
  *  Vladimir Kondratiev <wulf@mail.mipt.ru>
  *  William Grzybowski <wg@FreeBSD.org>
  *  William Grzybowski <william88@gmail.com>
  *  Yi-Hsuan Hsin <mhsin@mhsin.org>
  *  Zastupov Stepan [RedChrom] <redchrom@mail.ru>
  *  adamw
  *  alex
  *  arved
  *  erich@FreeBSD.org
  *  freebsd-ports@evilcode.net
  *  giffunip@asme.org
  *  ijliao
  *  kamikaze@bsdforen.de
  *  michael johnson <ahze@ahze.net>
  *  mikael.urankar@gmail.com
  *  mm
  *  nox@FreeBSD.org
  *  osa
  *  pb@FreeBSD.org
  *  piero
  *  se@FreeBSD.org
  *  sumikawa

With hat:	portmgr
63f36d3262
Tobias C. Berner (tcberner)
framework: convert bsd.gstreamer.mk to Uses/gstreamer.mk

- convert bsd.gstreamer.mk to Uses/gstreamer.mk
- convert ports tree to make use of USES=gstreamer
- remove duplicate dependency lines from the tree

Differential Revision: https://reviews.freebsd.org/D35097
ca3f925d6e
Charlie Li (vishwin)
textproc/libxml2: bump all LIB_DEPENDS consumers

This is a separate commit to facilitate easier cherry-picking for
quarterly.

PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
d63665f7cd
Matthias Fechner (mfechner)
textproc/libxml2: bump all dependencies

This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
247c7db751
Mathieu Arnold (mat)
Remove # $FreeBSD$ from Makefiles.
305f148f48
Koop Mast (kwm)
Update gstreamer1 to 1.16.2.

- The spc plugin was removed inflavor for the gsm plugin.
- Added in tree qt plugin.

Changelog: https://gstreamer.freedesktop.org/releases/1.16/#1.16.2

Update net-im/fractal to 4.2.2 to support GStreamer 1.16 (approved by maintainer)

Thanks to antoine@ for the exp-run.

PR:		239386
aa49f23a6d
Tijl Coosemans (tijl)
Update GStreamer to 1.14.4.

PR:		231406
Submitted by:	Greg V <greg@unrelenting.technology>
Exp-run by:	antoine
Approved by:	portmgr (antoine)
54c5444eba
Jan Beich (jbeich)
multimedia/x264: update to 0.155.2917

- HI10P is always built after https://git.videolan.org/?p=x264.git;a=commitdiff;h=71ed44c73124

Changes:	https://git.videolan.org/?p=x264.git;a=shortlog;h=0a84d986e7020f8344f00752e3600b9769cc1e85
ABI:		https://abi-laboratory.pro/tracker/timeline/x264/
d6bccda8d9
Koop Mast (kwm)
Update GStreamer1 ports to 1.12.2.

Rework the adding of dependancies in Mk/bsd.gstreamer.mk.
Previous when using USE_GSTREAMER[1] it would just add the request modules to BUILD/RUN_DEPENDS. This caused the qa script to complain because the old code didn't implicit depend on the gstreamer1 and gstreamer1-plugins[-bad] ports for the libraries they carried, even if they where present via the plugins! The new code adds implicit depends on these ports so USE_GSTREAMER[1] using ports have all the libraries included.

* The mad mp3 plugin was removed, mpg123 plugin also provides mp3 decoding. Switch over ports that used the gstreamer1 mad plugin.
* gtksink plugin renamed -> gtk
* Hook up the sndio plugin into the framework
* Add some indirect dependacies where needed
* Reorder the plugin list in bsd.gstreamer.mk so only one plugin per line. When changing plugins it doesn't result in multiple lines being changed.
* Remove mentions in bsd.gstreamer.mk of plugins mentions that where removed.
* Depend on libunwind on i386/amd64, GStreamer links to it if it is present.

PR:		220753
Exp-run by:	antoine@
d566d54fa6
Mathieu Arnold (mat)
Remove ${PORTSDIR}/ from dependencies, categories m, n, o, and p.

With hat:	portmgr
Sponsored by:	Absolight
8d6597e0bb
Koop Mast (kwm)
Update GStreamer1 to 1.6.2. Update GStreamer1-vaapi to 0.7.0.

* Spell GStreamer consistently. [1]
* Fix typo in py3kplist in py3-gstreamer1 [1]
* Improve plugins COMMENTS (more improvements welcome)
* Actually include the gstreamer1-libav update this time.

PR:		204204 [1] (based on)
Submitted by:	olivierd@ [1]
353ad9c72e
Koop Mast (kwm)
Update gstreamer1 ports to 1.6.0.

* gstreamer1-libav now uses ffmpeg from ports.
* New ports:
  * gstreamer1-validate: Tools to detect if elements are not behaving
    as expected, mainly aimed at developers, or advanced debugging.
  * gstreamer1-rtsp-server: Base foundation for building a rtsp
    server ontop of GStreamer
 * Bunch of new plugins like: mpg123, rsvg, libde265, openh264, x265 and dtls.

Release announcement:
  http://lists.freedesktop.org/archives/gstreamer-announce/2015-September/000357.html

Obtained from:	gnome devel repo
7b97259096
Koop Mast (kwm)
Big Gstreamer update:

Update gstreamer, gstreamer-plugins, -good, -bad and -ugly ports to 1.4.4.
Update gstreamer1-plugins-gnonlin to 1.4.0.
Update py-gstreamer1 and py3-gstreamer1 to 1.4.0.

Add multimedia/gstreamer1-editing-services. GES is a high-level library
for facilitating the creation of audio/video non-linear editors.

Add pulseaudio plugin now that pulseaudio is updated and add the gl plugin.

Drop :keepla from USES=libtool.
Drop @dirrm[try] from plists and drop gnomehier from USE_GNOME
Switch to optionhelpers in multimedia/gstreamer1.

PR:		194922 (merged with my own WIP)
Submitted by:	olivierd
c6e9859c13
Thomas Zander (riggs)
- Make gstreamer{,1}-plugins-{good,bad,ugly} respect MAKE_JOBS during build

PR:		189096
Submitted by:	jiashiun@gmail.com
Approved by:	mentors (implicit)
d2a12805c5
Baptiste Daroussin (bapt)
Convert GMAKE to MAKE_CMD Please note that lots of invocation of MAKE_CMD here are wrong as they do not properly respect MAKE_ENV and friends

With hat:	portmgr
a33191366c
Tijl Coosemans (tijl)
Update gstreamer 1.0 ports to version 1.2.4.
ce5a9a5d44
Tijl Coosemans (tijl)
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la.  So everything that subsequently links with libA will also link to these extra libraries.  This causes too much overlinking.

This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging.  However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.

So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).

PORTREVISION is bumped on all ports with USES=libtool that install .la
libraries.  Most ports are also changed to add :keepla because .la
libraries have to be kept around as long as there are dependent ports with
.la libraries that refer to them in their dependency_libs field.  In most
cases :keepla can be removed again as soon as all dependent ports that
install .la libraries have some form of USES=libtool added to their
Makefile.

PR:		ports/188759
Exp-run:	bdrewery
Approved by:	portmgr (bdrewery)
aad09bc5e2
Koop Mast (kwm)
Stagify Gstreamer ports. Fix build of gstreamer and gstreamer1 with glib 2.38.x [1]. Update gstreamer and gstreamer-plugins to new rules, USES=gmake pathfix, new LIB_DEPENDS syntax. Only pull in flex if base version is too old. Be more selective for which OSVERSIONS we need gcc due to the clang bug.

Obtained from:	Gstreamer upstream [1]
44d0dc12bb
Baptiste Daroussin (bapt)
Add NO_STAGE all over the place in preparation for the staging support (cat: multimedia)
855fb638fb
Koop Mast (kwm)
Add Gstreamer 1.0.7. This is the new stable version of the Gstreamer multimedia framework.

Use the USE_GSTREAMER1 macro to select Gstreamer 1.0 plugins. A new chapter
for the porters handbook about gstreamer is a work in progress.

X related plugins are now stand alone. The gio plugin is now part of the
gstreamer1-plugins port and the oss plugins are now part of the
gstreamer1-plugins-good port.

Note that the pulseaudio plugin is missing because it needs a newer version
of pulseaudio. Also there are still a number of plugins from -bad which
haven't been ported to the 1.0 API yet.
05d2886d27