1. CVE-Search
  2. CVE-2016-9808
ID CVE-2016-9808
Summary The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
References
Vulnerable Configurations
  • cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*
    cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 05-01-2018 - 02:31)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • bugzilla
    id 1401874
    title CVE-2016-9807 gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment gstreamer-plugins-good is earlier than 0:0.10.23-4.el6_8
            oval oval:com.redhat.rhsa:tst:20162975001
          • comment gstreamer-plugins-good is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20162975002
        • AND
          • comment gstreamer-plugins-good-devel is earlier than 0:0.10.23-4.el6_8
            oval oval:com.redhat.rhsa:tst:20162975003
          • comment gstreamer-plugins-good-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20162975004
    rhsa
    id RHSA-2016:2975
    released 2016-12-21
    severity Important
    title RHSA-2016:2975: gstreamer-plugins-good security update (Important)
  • bugzilla
    id 1401874
    title CVE-2016-9807 gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment gstreamer-plugins-good is earlier than 0:0.10.31-12.el7_3
            oval oval:com.redhat.rhsa:tst:20170019001
          • comment gstreamer-plugins-good is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20162975002
        • AND
          • comment gstreamer-plugins-good-devel-docs is earlier than 0:0.10.31-12.el7_3
            oval oval:com.redhat.rhsa:tst:20170019003
          • comment gstreamer-plugins-good-devel-docs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20170019004
    rhsa
    id RHSA-2017:0019
    released 2017-01-05
    severity Moderate
    title RHSA-2017:0019: gstreamer-plugins-good security update (Moderate)
  • bugzilla
    id 1401874
    title CVE-2016-9807 gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • comment gstreamer1-plugins-good is earlier than 0:1.4.5-3.el7_3
        oval oval:com.redhat.rhsa:tst:20170020001
      • comment gstreamer1-plugins-good is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20170020002
    rhsa
    id RHSA-2017:0020
    released 2017-01-05
    severity Moderate
    title RHSA-2017:0020: gstreamer1-plugins-good security update (Moderate)
rpms
  • gstreamer-plugins-good-0:0.10.23-4.el6_8
  • gstreamer-plugins-good-debuginfo-0:0.10.23-4.el6_8
  • gstreamer-plugins-good-devel-0:0.10.23-4.el6_8
  • gstreamer-plugins-good-0:0.10.31-12.el7_3
  • gstreamer-plugins-good-debuginfo-0:0.10.31-12.el7_3
  • gstreamer-plugins-good-devel-docs-0:0.10.31-12.el7_3
  • gstreamer1-plugins-good-0:1.4.5-3.el7_3
  • gstreamer1-plugins-good-debuginfo-0:1.4.5-3.el7_3
refmap via4
bid 95446
confirm https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
gentoo GLSA-201705-10
misc https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-incorrect-fix-for-gstreamer.html
mlist
  • [oss-security] 20161201 gstreamer multiple issues
  • [oss-security] 20161204 Re: gstreamer multiple issues
Last major update 05-01-2018 - 02:31
Published 13-01-2017 - 16:59
Last modified 05-01-2018 - 02:31
Back to Top