Medium ELSA-2017-0021 4 CVEs

Moderate: gstreamer1-plugins-bad-free security update (Oracle Linux 7)

Published Jan 5, 2017 · Updated Jan 5, 2017

Ecosystem: Oracle Linux

Summary

[1.4.5-6]
- Fix h264 and h265 buffer size checks
- Fix mpegts pat parsing and add more size checks
Resolves: rhbz#1400897

[1.4.5-5]
- vmncdec: Sanity-check width/height before using it
Resolves: rhbz#1400897

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 7	gstreamer1-plugins-bad-free	0:1.4.5-6.el7_3
Oracle Linux · 7	gstreamer1-plugins-bad-free-devel	0:1.4.5-6.el7_3

Vulnerabilities 4

Unscored —

CVE-2016-9445

Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via …

gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad0.10 Debian Ubuntu

Jan 23, 2017
Unscored —

CVE-2016-9809

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have uns…

gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad0.10 gst-plugins-bad1 Debian Ubuntu Alpine

Jan 13, 2017
Unscored —

CVE-2016-9812

The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a…

gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad1 Debian Ubuntu Alpine

Jan 13, 2017
Unscored —

CVE-2016-9813 Public exploit

The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of se…

gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad1 Debian Ubuntu Alpine

Jan 13, 2017