Ubuntu 16.10 USN-3135-1 Critical: GStreamer Plugin Application Crash

ubuntu

November 22, 2016

GStreamer could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

GStreamer could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- gst-plugins-good1.0: GStreamer plugins

- gst-plugins-good0.10: GStreamer plugins

Details:

Chris Evans discovered that GStreamer Good Plugins did not correctly handle

malformed FLC movie files. If a user were tricked into opening a crafted

FLC movie file with a GStreamer application, an attacker could cause a

denial of service via application crash, or execute arbitrary code with the

privileges of the user invoking the program.

Topics Covered

security advisory denial of service update critical application crash ubuntu gstreamer

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  gstreamer1.0-plugins-good       1.8.3-1ubuntu1.1

Ubuntu 16.04 LTS:
  gstreamer1.0-plugins-good       1.8.2-1ubuntu0.2

Ubuntu 14.04 LTS:
  gstreamer0.10-plugins-good      0.10.31-3+nmu1ubuntu5.1
  gstreamer1.0-plugins-good       1.2.4-1~ubuntu1.1

Ubuntu 12.04 LTS:
  gstreamer0.10-plugins-good      0.10.31-1ubuntu1.3

In general, a standard system update will make all the necessary changes.