Out-of-bounds read in gst-plugins-bad1 - CVE-2016-9809

Vulnerability identifier: #VU32108

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9809

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.

gst-plugins-bad1
gst-plugins-bad1 (Alpine package)
gstreamer-plugins-bad-free (Red Hat package)
gstreamer-plugins-bad-free
gstreamer1-plugins-bad-free (Red Hat package)
gstreamer1-plugins-bad-free
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Fedora

Install update from vendor's website.

gst-plugins-bad1 (Alpine package) - update to 1.8.3-r0
gstreamer-plugins-bad-free (Red Hat package) - update to 0.10.23-22.el7_3
gstreamer-plugins-bad-free - addressed in versions 0.10.23-34.fc24, 0.10.23-35.fc25
gstreamer1-plugins-bad-free (Red Hat package) - update to 1.4.5-6.el7_3
gstreamer1-plugins-bad-free - update to 1.8.3-3.fc24

• http://rhn.redhat.com/errata/RHSA-2017-0018.html
• http://rhn.redhat.com/errata/RHSA-2017-0021.html
• http://www.debian.org/security/2017/dsa-3818
• http://www.openwall.com/lists/oss-security/2016/12/01/2
• http://www.openwall.com/lists/oss-security/2016/12/05/8
• http://www.securityfocus.com/bid/95147
• https://bugzilla.gnome.org/show_bug.cgi?id=774896
• https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
• https://lists.debian.org/debian-lts-announce/2020/03/msg00038.html
• https://security.gentoo.org/glsa/201705-10

• Out-of-bounds read in GStreamer gst-plugins-bad1
• Out-of-bounds read in gst-plugins-bad1 (Alpine package)
• Fedora 25 update for gstreamer-plugins-bad-free
• Fedora 24 update for gstreamer-plugins-bad-free
• Fedora 24 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 7 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 7 update for gstreamer-plugins-bad-free