CVE-2016-10198

The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.

GStreamer is a pipeline-based multimedia framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. GStreamer supports a wide variety of media-handling components, such as real-time sound processing and videos playback, and about anything else media-related. The formats and processes can be changed in plugins since its plugin-based architecture. GStreamer plugins "Good" represents a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.(CVE-2016-10198)

The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.

A crafted AAC audio file could have caused an invalid read and thus corruption or denial of service (CVE-2016-10198).

A crafted mp4 file could have caused an invalid read and thus corruption or denial of service (CVE-2016-10199).

A crafted AVI file could have caused an invalid read and thus corruption or denial of service (CVE-2017-5840).

A crafted AVI file with metadata tag entries (ncdt) could have caused invalid read access and thus corruption or denial of service (CVE-2017-5841).

A crafted AVI file could have caused an invalid read access resulting in denial of service (CVE-2017-5845).

Note that GStreamer 0.10 was only affected by CVE-2016-10198 and CVE-2017-5840.

These are all security issues fixed in the gstreamer-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.

This update for gstreamer-plugins-good fixes the following issues:

• A crafted aac audio file could have caused an invalid read and thus corruption or denial of service (bsc#1024014, CVE-2016-10198)
• A crafted mp4 file could have caused an invalid read and thus corruption or denial of service (bsc#1024017, CVE-2016-10199)
• A crafted avi file could have caused an invalid read and thus corruption or denial of service (bsc#1024034, CVE-2017-5840)

This update for gstreamer-plugins-good fixes the following issues:

• A crafted aac audio file could have caused an invalid read and thus corruption or denial of service (bsc#1024014, CVE-2016-10198)
• A crafted mp4 file could have caused an invalid read and thus corruption or denial of service (bsc#1024017, CVE-2016-10199)
• A crafted avi file could have caused an invalid read and thus corruption or denial of service (bsc#1024034, CVE-2017-5840)
• A crafted AVI file with metadata tag entries (ncdt) could have caused invalid read access and thus corruption or denial of service (bsc#1024030, CVE-2017-5841)
• A crafted avi file could have caused an invalid read access resulting in denial of service (bsc#1024062, CVE-2017-5845)

Hanno Böck discovered that GStreamer Good Plugins did not correctly handle certain malformed media files. If a user were tricked into opening a crafted media file with a GStreamer application, an attacker could cause a denial of service via application crash.