ArchLinux: 201701-3: gst-plugins-bad: multiple issues
Summary
- CVE-2016-9445 (arbitrary code execution)
The vmnc decoder in gst-plugins-bad of the gstreamer code base contains
a width * height * depth integer overflow in the allocation of the
render buffer inside gst/vmnc/vmncdec.c.
- CVE-2016-9446 (information disclosure)
An information disclosure vulnerability has been discovered in the
render canvas functionality of gst-plugins-bad due to the lack of
initializing the returned heap area of g_malloc(). An example for the
information leak would be thumbnailing a simple 1 frame vmnc movie that
does not draw to the allocated render canvas at all.
This could be a problem for anyone using gstreamer in a server
environment to provide a thumbnailing services.
Resolution
Upgrade to 1.10.2-2.
# pacman -Syu "gst-plugins-bad>=1.10.2-2"
The problems have been fixed upstream in version 1.10.2.
References
https://www.openwall.com/lists/oss-security/2016/11/18/13 https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe https://bugzilla.gnome.org/show_bug.cgi?id=774533 https://security.archlinux.org/CVE-2016-9445 https://security.archlinux.org/CVE-2016-9446
Workaround
None