Off-by-one Error Affecting gstreamer-plugins-bad-free package, versions <0:0.10.23-22.el7_3

Q: How to fix?

Upgrade RHEL:7 gstreamer-plugins-bad-free to version 0:0.10.23-22.el7_3 or higher. This issue was patched in RHSA-2017:0018 .

Threat Intelligence

0.65% (80^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL7-GSTREAMERPLUGINSBADFREE-4732613
published26 Jul 2021
disclosed23 Nov 2016

Report a new vulnerability Found a mistake?

Introduced: 23 Nov 2016

CVE-2016-9809 (opens in a new tab) CWE-193 (opens in a new tab)

How to fix?

Upgrade RHEL:7 gstreamer-plugins-bad-free to version 0:0.10.23-22.el7_3 or higher.
This issue was patched in RHSA-2017:0018.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gstreamer-plugins-bad-free package and not the gstreamer-plugins-bad-free package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.