Bug 1401874 (CVE-2016-9807) - CVE-2016-9807 gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
Summary: CVE-2016-9807 gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-9807
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1401939 1401940 1401941 1401942 1406725 1406726 1408378 1408379 1408383 1408384
Blocks: 1401937
TreeView+ depends on / blocked
 
Reported: 2016-12-06 10:24 UTC by Adam Mariš
Modified: 2019-09-29 14:01 UTC (History)
27 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An invalid memory read access flaw was found in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash.
Clone Of:
Environment:
Last Closed: 2017-01-16 08:38:57 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2975 0 normal SHIPPED_LIVE Important: gstreamer-plugins-good security update 2016-12-21 17:33:20 UTC
Red Hat Product Errata RHSA-2017:0019 0 normal SHIPPED_LIVE Moderate: gstreamer-plugins-good security update 2017-01-05 14:35:19 UTC
Red Hat Product Errata RHSA-2017:0020 0 normal SHIPPED_LIVE Moderate: gstreamer1-plugins-good security update 2017-01-05 15:05:36 UTC

Description Adam Mariš 2016-12-06 10:24:30 UTC 
An invalid memory read in flx_decode_chunks was found causing segmentation fault.

Upstream bug:

https://bugzilla.gnome.org/show_bug.cgi?id=774859

Upstream patch:

https://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=153a8ae752c90d07190ef45803422a4f71ea8bff

CVE assignment:

http://seclists.org/oss-sec/2016/q4/589
Comment 1 Adam Mariš 2016-12-06 12:38:25 UTC 
Created mingw-gstreamer-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 1401942]
Comment 2 Adam Mariš 2016-12-06 12:38:46 UTC 
Created mingw-gstreamer1-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 1401941]
Comment 3 Adam Mariš 2016-12-06 12:38:59 UTC 
Created gstreamer-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 1401940]
Comment 4 Adam Mariš 2016-12-06 12:39:16 UTC 
Created gstreamer1-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 1401939]
Comment 7 errata-xmlrpc 2016-12-21 12:34:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:2975 https://rhn.redhat.com/errata/RHSA-2016-2975.html
Comment 10 errata-xmlrpc 2017-01-05 09:36:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0019 https://rhn.redhat.com/errata/RHSA-2017-0019.html
Comment 11 errata-xmlrpc 2017-01-05 10:08:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0020 https://rhn.redhat.com/errata/RHSA-2017-0020.html
Note You need to log in before you can comment on or make changes to this bug.