PT-2017-10142 · Gstreamer+3 · Gstreamer+3

Marcus Meissner · Publicado 2016-11-15 · Atualizado 2018-01-05 · CVE-2016-9447

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gstreamer versions 0.10.x

Description The issue concerns a denial of service and potential arbitrary code execution through a crafted NSF music file. This is due to out-of-bounds read or write operations in the ROM mappings of the NSF decoder.

Recommendations For gstreamer versions 0.10.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Memory Corruption

Enumeração de Fraquezas

CWE-125

CWE-787

Identificadores relacionados

CESA-2016_2974

CESA-2017_0018

CVE-2016-9447

DLA-712-1

DSA-3713-1

MGASA-2018-0012

RHSA-2016:2974

RHSA-2016_2974

RHSA-2017:0018

RHSA-2017_0018

SUSE-SU-2017:0027-1

SUSE-SU-2017:0028-1

Produtos afetados

Centos

Red Hat

Suse

Gstreamer

Referências · 59

• 🔥 http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html · Exploit
• https://lists.centos.org/pipermail/centos-announce/2017-January/071671.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9445 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:0018 · Nota
• https://security-tracker.debian.org/tracker/source-package/gst-plugins-bad0.10 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2016-9809 · Nota
• https://bugzilla.suse.com/1010514 · Nota
• https://lists.centos.org/pipermail/centos-announce/2016-December/071664.html · Nota
• https://bugzilla.suse.com/1010829 · Nota
• https://osv.dev/vulnerability/CVE-2016-9447 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/11/18/13 · Nota
• https://debian.org/security/2017/dsa-3818 · Aviso do Fabricante
• https://debian.org/security/2016/dsa-3717 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2017-January/059115.html · Nota
• https://access.redhat.com/errata/RHSA-2016:2974 · Nota