Description
The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 13 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 12 | gst-plugins-good1.0 | 1.10.1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu4ubuntu2.16.04.2 | — |
| Ubuntu 16.04 LTS | gst-plugins-good1.0 | 1.8.2-1ubuntu0.3 | — |
| Ubuntu 14.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu1ubuntu5.2 | — |
| Ubuntu 14.04 LTS | gst-plugins-good1.0 | 1.2.4-1~ubuntu1.3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | RHSA-2017:0019 |
| RHEL 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | RHSA-2017:0020 |
| RHEL 6 | gstreamer-plugins-good +1 | 0.10.23-4.el6_8 | RHSA-2016:2975 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | gstreamer-0_10-plugins-good | 0.10.31-16.1 | SUSE-SU-2017:0210-1 |
| SLES 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES 12 SP1 | gstreamer-0_10-plugins-good | 0.10.31-13.3.3 | SUSE-SU-2017:0237-1 |
| SLES 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES for SAP 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES for SAP 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | ELSA-2017-0019 |
| Oracle Linux 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | ELSA-2017-0020 |
Advisories 10
- RHSA-2017:0019 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2017:0020 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:2975 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- SUSE-SU-2017:0225-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3288-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0237-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3303-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0210-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-0019 Moderate: gstreamer-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
- ELSA-2017-0020 Moderate: gstreamer1-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
References
- RHSA-2017:0019 vendor-advisory
- RHSA-2016:2975 vendor-advisory
- https://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=153a8ae752c90d07190ef45803422a4f71ea8bff
- RHSA-2017:0020 vendor-advisory
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- https://bugzilla.gnome.org/show_bug.cgi?id=774859
- [oss-security] 20161204 Re: gstreamer multiple issues mailing-list
- GLSA-201705-10 vendor-advisory
- [oss-security] 20161201 gstreamer multiple issues mailing-list
- 95148 vdb-entry