The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es) :

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9445)

* Multiple flaws were discovered in GStreamer's H.264 and MPEG-TS plug-ins. A remote attacker could use these flaws to cause an application using GStreamer to crash. (CVE-2016-9809, CVE-2016-9812, CVE-2016-9813)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-10 (GStreamer plug-ins: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in various GStreamer       plug-ins. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system using a       GStreamer plug-in to process a specially crafted file, resulting in the       execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

According to the versions of the gstreamer1-plugins-bad-free package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in GStreamer's VMware VMnc     video file format decoding plug-in. A remote attacker     could use this flaw to cause an application using     GStreamer to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application. (CVE-2016-9445)

  - Multiple flaws were discovered in GStreamer's H.264 and     MPEG-TS plug-ins. A remote attacker could use these     flaws to cause an application using GStreamer to crash.
    (CVE-2016-9809, CVE-2016-9812, CVE-2016-9813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened.

This update for gstreamer-plugins-bad fixes the following issues :

  - CVE-2016-9809: Off by one read in     gst_h264_parse_set_caps() (bsc#1013659).

  - CVE-2016-9812: Out of bounds read in     gst_mpegts_section_new (bsc#1013678).

  - CVE-2016-9813: mpegts parser: NULL pointer deref in
    _parse_pat (bsc#1013680).

This update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes :

  - Check an integer overflow (CVE-2016-9445) and initialize     a buffer (CVE-2016-9446) in vmncdec. (bsc#1010829)

  - CVE-2016-9809: Ensure codec_data has the right size when     reading number of SPS (bsc#1013659).

  - CVE-2016-9812: Add more section size checks     (bsc#1013678).

  - CVE-2016-9813: fix PAT parsing (bsc#1013680).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es) :

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9445)

* Multiple flaws were discovered in GStreamer's H.264 and MPEG-TS plug-ins. A remote attacker could use these flaws to cause an application using GStreamer to crash. (CVE-2016-9809, CVE-2016-9812, CVE-2016-9813)

Security Fix(es) :

  - An integer overflow flaw, leading to a heap-based buffer     overflow, was found in GStreamer's VMware VMnc video     file format decoding plug-in. A remote attacker could     use this flaw to cause an application using GStreamer to     crash or, potentially, execute arbitrary code with the     privileges of the user running the application.
    (CVE-2016-9445)

  - Multiple flaws were discovered in GStreamer's H.264 and     MPEG-TS plug- ins. A remote attacker could use these     flaws to cause an application using GStreamer to crash.
    (CVE-2016-9809, CVE-2016-9812, CVE-2016-9813)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0021 advisory.

    [1.4.5-6]
    - Fix h264 and h265 buffer size checks
    - Fix mpegts pat parsing and add more size checks     Resolves: rhbz#1400897

    [1.4.5-5]
    - vmncdec: Sanity-check width/height before using it     Resolves: rhbz#1400897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0021 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc     video file format decoding plug-in. A remote attacker could use this flaw to cause an application using     GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the     application. (CVE-2016-9445)

    * Multiple flaws were discovered in GStreamer's H.264 and MPEG-TS plug-ins. A remote attacker could use     these flaws to cause an application using GStreamer to crash. (CVE-2016-9809, CVE-2016-9812,     CVE-2016-9813)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gstreamer-plugins-bad fixes the following issues :

  - CVE-2016-9809: Malicious mkv/h264 file could cause an     off by one out of bounds read and lead to crash     (bsc#1013659)

  - CVE-2016-9812: Malicious mpeg file could cause invalid a     NULL pointer access and lead to crash (bsc#1013678)

  - CVE-2016-9813: Malicious mpegts file could cause invalid     a NULL pointer access and lead to crash (bsc#1013680)

  - CVE-2016-9445, CVE-2016-9446: Check an integer overflow     and initialize a buffer in vmncdec (bsc#1010829)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes :

  - Check an integer overflow (CVE-2016-9445) and initialize     a buffer (CVE-2016-9446) in vmncdec. (bsc#1010829)

  - CVE-2016-9809: Ensure codec_data has the right size when     reading number of SPS (bsc#1013659).

  - CVE-2016-9812: Add more section size checks     (bsc#1013678).

  - CVE-2016-9813: fix PAT parsing (bsc#1013680).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
101404	Virtuozzo 7 : gstreamer1-plugins-bad-free / etc (VZLSA-2017-0021)	Nessus	Virtuozzo Local Security Checks	high
100263	GLSA-201705-10 : GStreamer plug-ins: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
99854	EulerOS 2.0 SP1 : gstreamer1-plugins-bad-free (EulerOS-SA-2017-1008)	Nessus	Huawei Local Security Checks	high
99853	EulerOS 2.0 SP2 : gstreamer1-plugins-bad-free (EulerOS-SA-2017-1007)	Nessus	Huawei Local Security Checks	high
99004	Debian DSA-3818-1 : gst-plugins-bad1.0 - security update	Nessus	Debian Local Security Checks	high
96558	openSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-94)	Nessus	SuSE Local Security Checks	high
96550	openSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-84)	Nessus	SuSE Local Security Checks	high
96382	openSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-63)	Nessus	SuSE Local Security Checks	high
96342	CentOS 7 : gstreamer1-plugins-bad-free (CESA-2017:0021)	Nessus	CentOS Local Security Checks	high
96330	Scientific Linux Security Update : gstreamer1-plugins-bad-free on SL7.x x86_64 (20170105)	Nessus	Scientific Linux Local Security Checks	high
96329	Oracle Linux 7 : gstreamer1-plugins-bad-free (ELSA-2017-0021)	Nessus	Oracle Linux Local Security Checks	high
96313	RHEL 7 : gstreamer1-plugins-bad-free (RHSA-2017:0021)	Nessus	Red Hat Local Security Checks	high
96259	SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3297-1)	Nessus	SuSE Local Security Checks	high
96258	SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3296-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-9813

medium

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high