PT-2017-10342 · Gstreamer+4 · Gstreamer+4

Hanno Böck · Published 2016-11-29 · Updated 2018-01-05 · CVE-2016-9807

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.10.2

Description The issue allows remote attackers to cause a denial of service, resulting in an invalid memory read and crash, by providing a crafted FLIC file. This is due to a problem in the flx decode chunks function.

Recommendations For versions prior to 1.10.2, update to version 1.10.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted FLIC files until the update is applied.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2016-2372

CESA-2016_2975

CESA-2017_0019

CESA-2017_0020

CVE-2016-9807

MGASA-2016-0424

OPENSUSE-SU-2017_0071-1

OPENSUSE-SU-2017_0141-1

OPENSUSE-SU-2017_0151-1

OPENSUSE-SU-2017_0160-1

OPENSUSE-SU-2017_0298-1

RHSA-2016:2975

RHSA-2016_2975

RHSA-2017:0019

RHSA-2017:0020

RHSA-2017_0019

RHSA-2017_0020

SUSE-SU-2016:3288-1

SUSE-SU-2016:3303-1

SUSE-SU-2017:0210-1

SUSE-SU-2017:0225-1

SUSE-SU-2017:0237-1

Affected Products

Alt Linux

Centos

Gstreamer

Red Hat

Suse

References · 97

• http://rhn.redhat.com/errata/RHSA-2016-2975.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-2372 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9809 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9807 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9810 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9635 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-9807 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9807 · Security Note
• https://linux.oracle.com/errata/ELSA-2017-0020.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9807 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9634 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3303-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9636 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9807 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9811 · Security Note