CVE-2016-9446

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.

Chris Evans discovered that the GStreamer plugin to decode VMware screen capture files allowed the execution of arbitrary code (CVE-2016-9445, CVE-2016-9446).

Chris Evans discovered that the GStreamer 0.10 plugin to decode NES Sound Format files allowed the execution of arbitrary code (CVE-2016-9447).

Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened (CVE-2016-9809, CVE-2016-9812, CVE-2016-9813, CVE-2017-5843, CVE-2017-5848).

The gstreamer0.10-plugins-bad package was affected by CVE-2016-9445, CVE-2016-9446, CVE-2016-9447, CVE-2016-9809, CVE-2017-5843, and CVE-2017-5848).

The gstreamer1.0-plugins-bad package was affected by CVE-2016-9445, CVE-2016-9446, CVE-2016-9809, CVE-2016-9812, CVE-2016-9813, CVE-2017-5843, and CVE-2017-5848.

This update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes:

• Check an integer overflow (CVE-2016-9445) and initialize a buffer (CVE-2016-9446) in vmncdec. (bsc#1010829)
• CVE-2016-9809: Ensure codec_data has the right size when reading number of SPS (bsc#1013659).
• CVE-2016-9812: Add more section size checks (bsc#1013678).
• CVE-2016-9813: fix PAT parsing (bsc#1013680).

This update for gstreamer-plugins-bad fixes the following issues:

• CVE-2016-9809: Malicious mkv/h264 file could cause an off by one out of bounds read and lead to crash (bsc#1013659)
• CVE-2016-9812: Malicious mpeg file could cause invalid a null pointer access and lead to crash (bsc#1013678)
• CVE-2016-9813: Malicious mpegts file could cause invalid a null pointer access and lead to crash (bsc#1013680)
• CVE-2016-9445, CVE-2016-9446: Check an integer overflow and initialize a buffer in vmncdec (bsc#1010829)

This update for gstreamer-0_10-plugins-bad fixes the following issues:

• CVE-2016-9445, CVE-2016-9446: Protection against buffer overflows (bsc#1010829)
• CVE-2016-9447: Disable the nsf plugin (bsc#1010514)

This update for gstreamer-0_10-plugins-bad fixes the following issues:

• CVE-2016-9445, CVE-2016-9446: Protection against buffer overflows (bsc#1010829)
• CVE-2016-9447: Disable the nsf plugin (bsc#1010514)