CVSS: 7.5EPSS: 3%CPEs: 15EXPL: 0CVE-2017-5848 – gstreamer-plugins-bad-free: Invalid memory read in gst_ps_demux_parse_psm
https://notcve.org/view.php?id=CVE-2017-5848
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing. La función gst_ps_demux_parse_psm en gst/mpegdemux/gstmpegdemux.c en gst-plugins-bad en GStreamer permite a atacantes remotos provocar una denegación de servicio (lectura de memoria no válida y caída) a través de vectores que implican análisis PSM. • http://www.debian.org/security/2017/dsa-3818 http://www.openwall.com/lists/oss-security/2017/02/01/7 http://www.openwall.com/lists/oss-security/2017/02/02/9 http://www.securityfocus.com/bid/96001 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=777957#c3 https://lists.debian.org/debian-lts-announce/2020/03/msg00038.html https://security.gentoo.org/glsa/201705-10 https://access.redhat.com/security/cve/CVE-2017-5848&# • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2016-9446 – gstreamer-plugins-bad-free: Missing initialization of allocated heap memory leads to information leak
https://notcve.org/view.php?id=CVE-2016-9446
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas. El decodificador vmnc en el gstreamer no inicializa el lienzo de renderizado, lo que permite a permite a atacantes remotos obtener información sensible como se demuestra mediante la miniatura de una simple película vmnc de un frame que no dibuja el lienzo de renderizado asignado. • http://www.openwall.com/lists/oss-security/2016/11/18/12 http://www.openwall.com/lists/oss-security/2016/11/18/13 http://www.securityfocus.com/bid/94423 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=774533 https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM7IXFGHV66KNWGWG6ZBDNKXD2UJL2VQ http • CWE-456: Missing Initialization of a Variable CWE-665: Improper Initialization •
CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9810 – gstreamer: Invalid memory read in g_type_check_instance_is_fundamentally_a
https://notcve.org/view.php?id=CVE-2016-9810
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call. La función gst_decode_chain_free_internal en el decodificador flxdex en gst-plugins-good en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos provocar una denegación de servicio (lectura de memoria no válida y caída) a través de un archivo no válido, lo que desencadena una llamada unref incorrecta . • http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95163 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=774897 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://security.gentoo.org/glsa/201705-10 https://access.redhat.com/security/cve/CVE-2016-9810 https://bugzilla.redhat.com/show_bug.cgi?id=1401913 • CWE-125: Out-of-bounds Read •
CVSS: 4.7EPSS: 1%CPEs: 16EXPL: 0CVE-2016-9811 – gstreamer: Out of bounds heap read in windows_icon_typefind
https://notcve.org/view.php?id=CVE-2016-9811
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. La función windows_icon_typefind en gst-plugins-base en GStreamer en versiones anteriores a 1.10.2, cuando G_SLICE esta configurado para malloc siempre, permite a atacantes remotos provocar una denegación de servicio (lectura fuera de los límites) a través de un archivo ico manipulado. • http://www.debian.org/security/2017/dsa-3819 http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95161 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=774902 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://lists.debian.org/debian-lts-announce/2020/02/msg00032.html https://lists.fedoraproject.org/archives/lis • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9809 – gstreamer-plugins-bad-free: Off-by-one read in gst_h264_parse_set_caps
https://notcve.org/view.php?id=CVE-2016-9809
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read. Error por un paso en la función gst_h264_parse_set_caps en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos tener un impacto no especificado a través de un archivo manipulado, lo que desencadena una lectura fuera de límites. An out-of-bounds heap read flaw was found in GStreamer's H.264 parser. A remote attacker could use this flaw to cause an application using GStreamer to crash. • http://rhn.redhat.com/errata/RHSA-2017-0018.html http://rhn.redhat.com/errata/RHSA-2017-0021.html http://www.debian.org/security/2017/dsa-3818 http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95147 https://bugzilla.gnome.org/show_bug.cgi?id=774896 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://lists.debian.org/debian-lts-announce/2020/03&# • CWE-125: Out-of-bounds Read CWE-193: Off-by-one Error •