gstreamer-plugins-bad-free: Integer overflow when allocating render buffer in VMnc decoder
Published Jan 23, 2017
7.5
HIGHCVSS 3.1
EPSS 4.84%
Description
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
Affected products
No data.
No data.
Red Hat Enterprise Linux 6
gstreamer-plugins-bad-free-0:0.10.19-5.el6_8
Fixed · RHSA-2016:2974
Red Hat Enterprise Linux 7
gstreamer-plugins-bad-free-0:0.10.23-22.el7_3
Fixed · RHSA-2017:0018
Red Hat Enterprise Linux 7
gstreamer1-plugins-bad-free-0:1.4.5-6.el7_3
Fixed · RHSA-2017:0021
Red Hat Enterprise Linux 5
gstreamer
Not affected
Red Hat Enterprise Linux 6
gstreamer
Not affected
Red Hat Enterprise Linux 7
gstreamer
Not affected
Red Hat Enterprise Linux 7
gstreamer1
Not affected
Red Hat Enterprise Virtualization 3
mingw-virt-viewer
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | gstreamer-plugins-bad-free-0:0.10.19-5.el6_8 | Fixed | RHSA-2016:2974 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-bad-free-0:0.10.23-22.el7_3 | Fixed | RHSA-2017:0018 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-bad-free-0:1.4.5-6.el7_3 | Fixed | RHSA-2017:0021 |
| Red Hat Enterprise Linux 5 | gstreamer | Not affected | n/a |
| Red Hat Enterprise Linux 6 | gstreamer | Not affected | n/a |
| Red Hat Enterprise Linux 7 | gstreamer | Not affected | n/a |
| Red Hat Enterprise Linux 7 | gstreamer1 | Not affected | n/a |
| Red Hat Enterprise Virtualization 3 | mingw-virt-viewer | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
This mitigation is only required if vulnerable gstreamer-plugins-bad-free and/or gstreamer1-plugins-bad-free packages are installed. For RHEL 7, sudo rm /usr/lib*/gstreamer-1.0/libgstvmnc.so sudo rm /usr/lib*/gstreamer-0.10/libgstvmnc.so For RHEL 6, sudo rm /usr/lib*/gstreamer-0.10/libgstvmnc.so Please note that this mitigation deletes the vulnerable VMware NC decoder, which removes the functionality to play VMware movie files.
References (15)
- http://rhn.redhat.com/errata/RHSA-2016-2974.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2017-0018.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2017-0021.html vendor-advisoryx_refsource_REDHAT
- http://www.openwall.com/lists/oss-security/2016/11/18/12 mailing-listx_refsource_MLIST
- http://www.openwall.com/lists/oss-security/2016/11/18/13 mailing-listx_refsource_MLIST
- http://www.securityfocus.com/bid/94421 vdb-entryx_refsource_BID
- https://access.redhat.com/security/cve/CVE-2016-9445 Vendor Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=774533 x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=1395767 Issue Tracking
- https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2016-9445
- https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html?m=1
- https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html x_refsource_MISC
- https://security.gentoo.org/glsa/201705-10 vendor-advisoryx_refsource_GENTOO
- https://www.cve.org/CVERecord?id=CVE-2016-9445
Change history (0)
No recorded changes yet.