Ubuntu 16.10: USN-3135-2 Critical: GStreamer Denial of Service

ubuntu

November 28, 2016

GStreamer could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

GStreamer could be made to crash or run programs as your login if it opened

a specially crafted file.

Software Description:

- gst-plugins-good1.0: GStreamer plugins

- gst-plugins-good0.10: GStreamer plugins

Details:

USN-3135-1 fixed a vulnerability in GStreamer Good Plugins. The original

security fix was incomplete. This update fixes the problem.

Original advisory details:

Chris Evans discovered that GStreamer Good Plugins did not correctly handle

malformed FLC movie files. If a user were tricked into opening a crafted

FLC movie file with a GStreamer application, an attacker could cause a

denial of service via application crash, or execute arbitrary code with the

privileges of the user invoking the program.

Topics Covered

security advisory denial of service application crash ubuntu gstreamer

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  gstreamer1.0-plugins-good       1.8.3-1ubuntu1.2

Ubuntu 16.04 LTS:
  gstreamer1.0-plugins-good       1.8.2-1ubuntu0.3

Ubuntu 14.04 LTS:
  gstreamer0.10-plugins-good      0.10.31-3+nmu1ubuntu5.2
  gstreamer1.0-plugins-good       1.2.4-1~ubuntu1.3

Ubuntu 12.04 LTS:
  gstreamer0.10-plugins-good      0.10.31-1ubuntu1.4

In general, a standard system update will make all the necessary changes.