Description
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 13 | gst-plugins-good1.0 | 1.10.1-2 | — |
| Debian 12 | gst-plugins-good1.0 | 1.10.1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu4ubuntu2.16.04.2 | — |
| Ubuntu 16.04 LTS | gst-plugins-good1.0 | 1.8.2-1ubuntu0.3 | — |
| Ubuntu 14.04 LTS | gst-plugins-good0.10 | 0.10.31-3+nmu1ubuntu5.2 | — |
| Ubuntu 14.04 LTS | gst-plugins-good1.0 | 1.2.4-1~ubuntu1.3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | RHSA-2017:0019 |
| RHEL 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | RHSA-2017:0020 |
| RHEL 6 | gstreamer-plugins-good +1 | 0.10.23-4.el6_8 | RHSA-2016:2975 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | gstreamer-0_10-plugins-good | 0.10.31-16.1 | SUSE-SU-2017:0210-1 |
| SLES 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES 12 SP1 | gstreamer-0_10-plugins-good | 0.10.31-13.3.3 | SUSE-SU-2017:0237-1 |
| SLES 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | gstreamer-plugins-good | 1.8.3-9.1 | SUSE-SU-2016:3303-1 |
| SLES for SAP 12 SP1 | gstreamer-plugins-good | 1.2.4-2.3.1 | SUSE-SU-2016:3288-1 |
| SLES for SAP 11 SP4 | gstreamer-0_10-plugins-good | 0.10.30-5.14.1 | SUSE-SU-2017:0225-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.23 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.22 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.21 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.20 | gst-plugins-good | 1.10.4-r0 | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.18 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.17 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.16 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.15 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.14 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.13 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.12 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.11 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.10 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.9 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.8 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.7 | gst-plugins-good | 1.10.4-r0 | — |
| Alpine v3.6 | gst-plugins-good1 | 1.10.4-r0 | — |
| Alpine v3.5 | gst-plugins-good1 | 1.8.3-r0 | — |
| Alpine v3.4 | gst-plugins-good1 | 1.8.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | gstreamer-plugins-good +1 | 0.10.31-12.el7_3 | ELSA-2017-0019 |
| Oracle Linux 7 | gstreamer1-plugins-good | 1.4.5-3.el7_3 | ELSA-2017-0020 |
Advisories 10
- RHSA-2017:0019 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2017:0020 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:2975 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- SUSE-SU-2017:0225-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3288-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0237-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3303-1 Security update for gstreamer-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0210-1 Security update for gstreamer-0_10-plugins-good SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-0019 Moderate: gstreamer-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
- ELSA-2017-0020 Moderate: gstreamer1-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 5, 2017
References
- https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-incorrect-fix-for-gstreamer.html
- RHSA-2017:0019 vendor-advisory
- RHSA-2016:2975 vendor-advisory
- RHSA-2017:0020 vendor-advisory
- 95446 vdb-entry
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- [oss-security] 20161204 Re: gstreamer multiple issues mailing-list
- GLSA-201705-10 vendor-advisory
- [oss-security] 20161201 gstreamer multiple issues mailing-list