Out-of-bounds Read Affecting gstreamer1-devel package, versions <0:1.10.4-2.el7
Threat Intelligence
EPSS
2.37% (84th percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL7-GSTREAMER1DEVEL-5165641
- published26 Jul 2021
- disclosed23 Nov 2016
Introduced: 23 Nov 2016
CVE-2016-9810 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade RHEL:7 gstreamer1-devel to version 0:1.10.4-2.el7 or higher.
This issue was patched in RHSA-2017:2060.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gstreamer1-devel package and not the gstreamer1-devel package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.
References
- http://www.securityfocus.com/bid/95163
- https://bugzilla.gnome.org/show_bug.cgi?id=774897
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- https://access.redhat.com/security/cve/CVE-2016-9810
- https://security.gentoo.org/glsa/201705-10
- http://www.openwall.com/lists/oss-security/2016/12/01/2
- http://www.openwall.com/lists/oss-security/2016/12/05/8
- https://access.redhat.com/errata/RHSA-2017:2060