PT-2017-10141 · Gstreamer+4 · Gstreamer+4

Chris Evans · Published 2016-11-17 · Updated 2021-11-30 · CVE-2016-9446

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gstreamer (affected versions not specified)

Description The issue concerns the vmnc decoder in the gstreamer, which fails to initialize the render canvas. This allows remote attackers to obtain sensitive information. An example of exploitation is through thumbnailing a simple 1-frame vmnc movie that does not draw to the allocated render canvas.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALT-PU-2017-1563

CESA-2017_2060

CVE-2016-9446

DLA-712-1

DSA-3717-1

MGASA-2018-0012

OPENSUSE-SU-2016_3147-1

OPENSUSE-SU-2016_3158-1

RHSA-2017:2060

RHSA-2017_2060

SUSE-SU-2016:3296-1

SUSE-SU-2016:3297-1

SUSE-SU-2017:0027-1

SUSE-SU-2017:0028-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Gstreamer

References · 136

• 🔥 https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5843 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3296-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5840 · Security Note
• https://debian.org/security/2017/dsa-3818 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00806 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9810 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1563 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3717-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5839 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5841 · Security Note
• https://debian.org/security/2016/dsa-3713 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5847 · Security Note
• https://linux.oracle.com/errata/ELSA-2017-2060.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9446 · Vendor Advisory