PT-2017-10345 · Gstreamer+4 · Gstreamer+4

Hanno Böck

·

Publicado

2016-11-29

·

Atualizado

2018-01-05

·

CVE-2016-9810

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.10.2
Description The issue allows remote attackers to cause a denial of service, resulting in an invalid memory read and crash, via an invalid file. This is triggered by an incorrect unref call in the gst decode chain free internal function within the flxdex decoder in gst-plugins-good.
Recommendations For versions prior to 1.10.2, update to version 1.10.2 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted files to minimize the risk of exploitation.

Correção

DoS

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2016-2372
CESA-2017_2060
CVE-2016-9810
MGASA-2016-0424
OPENSUSE-SU-2017_0071-1
OPENSUSE-SU-2017_0141-1
OPENSUSE-SU-2017_0151-1
OPENSUSE-SU-2017_0160-1
OPENSUSE-SU-2017_0298-1
RHSA-2017:2060
RHSA-2017_2060
SUSE-SU-2016:3288-1
SUSE-SU-2016:3303-1
SUSE-SU-2017:0210-1
SUSE-SU-2017:0225-1
SUSE-SU-2017:0237-1

Produtos afetados

Alt Linux
Centos
Gstreamer
Red Hat
Suse