Description
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 13 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 12 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 8 | gst-plugins-good0.10 | 0.10.31-3+nmu4+deb8u2 | DSA-3724-1 |
| Debian 8 | gst-plugins-good1.0 | 1.4.4-2+deb8u2 | DSA-3723-1 |
| Debian 7 | gst-plugins-good0.10 | 0.10.31-3+nmu1+deb7u1 | DLA-727-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu4ubuntu2.16.04.1 | — |
| Ubuntu 16.04 LTS | gst-plugins-good1.0 | 1.8.2-1ubuntu0.2 | — |
| Ubuntu 14.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu1ubuntu5.1 | — |
| Ubuntu 14.04 LTS | gst-plugins-good1.0 | 1.2.4-1~ubuntu1.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | RHSA-2017:0019 |
| RHEL 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | RHSA-2017:0020 |
| RHEL 6 | gstreamer-plugins-good +1 | 0.10.23-4.el6_8 | RHSA-2016:2975 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | gstreamer-0_10-plugins-good | 0.10.31-16.1 | SUSE-SU-2017:0210-1 |
| SLES 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES 12 SP1 | gstreamer-0_10-plugins-good | 0.10.31-13.3.3 | SUSE-SU-2017:0237-1 |
| SLES 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES for SAP 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES for SAP 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.23 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.22 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.21 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.20 | gst-plugins-good | 1.10.4-r0 | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.18 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.17 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.16 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.15 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.14 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.13 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.12 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.11 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.10 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.9 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.8 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.7 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.6 | gst-plugins-good1 | 1.10.4-r0 | — |
| Alpine v3.5 | gst-plugins-good1 | 1.8.3-r0 | — |
| Alpine v3.4 | gst-plugins-good1 | 1.8.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | ELSA-2017-0019 |
| Oracle Linux 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | ELSA-2017-0020 |
Advisories 13
- RHSA-2017:0019 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2017:0020 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:2975 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- DLA-727-1 gst-plugins-good0.10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3723-1 gst-plugins-good1.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3724-1 gst-plugins-good0.10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:0225-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3288-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0237-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3303-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0210-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-0019 Moderate: gstreamer-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
- ELSA-2017-0020 Moderate: gstreamer1-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
References
- DSA-3724 vendor-advisory
- RHSA-2017:0019 vendor-advisory
- RHSA-2016:2975 vendor-advisory
- DSA-3723 vendor-advisory
- RHSA-2017:0020 vendor-advisory
- 94499 vdb-entry
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- [oss-security] 20161123 Re: CVE Request: gstreamer plugins mailing-list
- https://bugzilla.gnome.org/show_bug.cgi?id=774834
- GLSA-201705-10 vendor-advisory
- https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-advancing-exploitation.html