CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
93.6%
Severity: High
Date : 2017-01-02
CVE-ID : CVE-2016-9445 CVE-2016-9446
Package : gst-plugins-bad
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-76
The package gst-plugins-bad before version 1.10.2-2 is vulnerable to
multiple issues including arbitrary code execution and information
disclosure.
Upgrade to 1.10.2-2.
The problems have been fixed upstream in version 1.10.2.
None
The vmnc decoder in gst-plugins-bad of the gstreamer code base contains
a width * height * depth integer overflow in the allocation of the
render buffer inside gst/vmnc/vmncdec.c.
An information disclosure vulnerability has been discovered in the
render canvas functionality of gst-plugins-bad due to the lack of
initializing the returned heap area of g_malloc(). An example for the
information leak would be thumbnailing a simple 1 frame vmnc movie that
does not draw to the allocated render canvas at all.
This could be a problem for anyone using gstreamer in a server
environment to provide a thumbnailing services.
An attacker is able to provide a crafted VMNC file that would allow for
either arbitrary code execution or disclose information of the memory
of the running host.
http://www.openwall.com/lists/oss-security/2016/11/18/13
https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
https://bugzilla.gnome.org/show_bug.cgi?id=774533
https://security.archlinux.org/CVE-2016-9445
https://security.archlinux.org/CVE-2016-9446
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | gst-plugins-bad | < 1.10.2-2 | UNKNOWN |
www.openwall.com/lists/oss-security/2016/11/18/13
bugzilla.gnome.org/show_bug.cgi?id=774533
cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
security.archlinux.org/AVG-76
security.archlinux.org/CVE-2016-9445
security.archlinux.org/CVE-2016-9446
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
93.6%