CVE-2016-9810

The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.

Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2016-9634, CVE-2016-9635, CVE-2016-9636, CVE-2016-9808).

An invalid memory read access flaw was found in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash (CVE-2016-9807, CVE-2016-9810).

Note that CVE-2016-9810 only affected gstreamer1.0-plugins-good.

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2016-9807: flic decoder invalid read could lead to crash [bsc#1013655]
• CVE-2016-9634: flic out-of-bounds write could lead to code execution [bsc#1012102]
• CVE-2016-9635: flic out-of-bounds write could lead to code execution [bsc#1012103]
• CVE-2016-9635: flic out-of-bounds write could lead to code execution [bsc#1012104]
• CVE-2016-9808: A maliciously crafted flic file can still cause invalid memory accesses. [bsc#1013653]
• CVE-2016-9810: A maliciously crafted flic file can still cause invalid memory accesses [bsc#1013663]

This update for gstreamer-plugins-good fixes the following security issues:

• CVE-2016-9807: Flic decoder invalid read could lead to crash. (bsc#1013655)
• CVE-2016-9634: Flic out-of-bounds write could lead to code execution. (bsc#1012102)
• CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012103)
• CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012104)
• CVE-2016-9808: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013653)
• CVE-2016-9810: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013663)

This update for gstreamer-0_10-plugins-good fixes the following issues:

• CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012102)
• CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012103)
• CVE-2016-9636: Prevent maliciously crafted flic files from causing invalid memory writes (bsc#1012104)
• CVE-2016-9807: Prevent the reading of invalid memory in flx_decode_chunks, leading to DoS (bsc#1013655)
• CVE-2016-9808: Prevent maliciously crafted flic files from causing invalid memory accesses (bsc#1013653)
• CVE-2016-9810: Invalid files can be used to extraneous unreferences, leading to invalid memory access and DoS (bsc#1013663)

gstreamer-0_10-plugins-good was updated to fix six security issues.

These security issues were fixed:

• CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012102)
• CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012103)
• CVE-2016-9636: Prevent maliciously crafted flic files from causing invalid memory writes (bsc#1012104).
• CVE-2016-9807: Prevent the reading of invalid memory in flx_decode_chunks, leading to DoS (bsc#1013655)
• CVE-2016-9808: Prevent maliciously crafted flic files from causing invalid memory accesses (bsc#1013653)
• CVE-2016-9810: Invalid files can be used to extraneous unreferences, leading to invalid memory access and DoS (bsc#1013663)

gstreamer-0_10-plugins-good was updated to fix five security issues.

These security issues were fixed:

• CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012103).
• CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012102).
• CVE-2016-9810: Invalid files can be used to extraneous unreferences, leading to invalid memory access and DoS (bsc#1013663).
• CVE-2016-9807: Prevent the reading of invalid memory in flx_decode_chunks, leading to DoS (bsc#1013655).
• CVE-2016-9808: Prevent maliciously crafted flic files from causing invalid memory accesses (bsc#1013653).

To install this update libbz2-1 needs to be installed if it isn't already present on the system.