Red Hat Security Advisory: GStreamer security, bug fix, and enhancement update

Fixed packages 120

Vulnerabilities 15

• Unscored —
  CVE-2016-10198

  The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good0.10 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-10199

  The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows rem…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good0.10 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-9446

  The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensit…

  gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad0.10 Debian Ubuntu
  Jan 23, 2017
• Unscored —
  CVE-2016-9810

  The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good0.10 Debian Ubuntu
  Jan 13, 2017
• Unscored —
  CVE-2016-9811

  The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc…

  gst-plugins-base1.0 gst-plugins-base1.0 gst-plugins-base0.10 gst-plugins-base1 Debian Ubuntu Alpine
  Jan 13, 2017
• Unscored —
  CVE-2017-5837

  The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.…

  gst-plugins-base1.0 gst-plugins-base1.0 gst-plugins-base0.10 gst-plugins-base1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5838

  The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attack…

  gstreamer1.0 gstreamer1.0 gstreamer0.10 Debian Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2017-5839

  The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.…

  gst-plugins-base1.0 gst-plugins-base1.0 gst-plugins-base1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5840

  The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good0.10 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5841

  The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows re…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5842

  The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 all…

  gst-plugins-base1.0 gst-plugins-base1.0 gst-plugins-base1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5843

  Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux…

  gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad0.10 Debian Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2017-5844

  The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.…

  gst-plugins-base1.0 gst-plugins-base1.0 gst-plugins-base0.10 gst-plugins-base1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5845

  The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows re…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good1 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2017-5848

  The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attac…

  gst-plugins-bad1.0 gst-plugins-bad1.0 gst-plugins-bad0.10 Debian Ubuntu
  Feb 9, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1265905
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1386833
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1386968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1397063
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1401913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1401918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419558
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419582
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419583
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419584
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419586
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419587
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419588
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419589
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1419600
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1420650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1428918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429587
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1430051
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2060.json
• report
  https://access.redhat.com/security/cve/CVE-2016-9446
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9446
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9446
• article
  https://scarybeastsecurity.blogspot.sk/2016/11/0day-poc-risky-design-decisions-in.html
• report
  https://access.redhat.com/security/cve/CVE-2016-9810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9810
• report
  https://access.redhat.com/security/cve/CVE-2016-9811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9811
• report
  https://access.redhat.com/security/cve/CVE-2016-10198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10198