CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9807 – gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
https://notcve.org/view.php?id=CVE-2016-9807
The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file. La función flx_decode_chunks en gst/flx/gstflxdec.c en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos provocar una denegación de servicio (lectura de memoria no válida y caída) a través de un archivo FLIC manipulado. An invalid memory read access flaw was found in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95148 https://bugzilla.gnome.org/show_bug.cgi?id=774859 https://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=153a8ae752c90d07190ef45803422a4f71ea8bff https://gstreamer. • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2016-9808 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9808
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs. El decodificador FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos provocar una denegación de servicio (escritura fuera de límites y caída) a través de una serie manipulada de saltar y contar pares. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95446 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-incorrect-fix-for-gstreamer.html https://security. • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 1%CPEs: 37EXPL: 0CVE-2016-9447 – gstreamer-plugins-bad-free: Memory corruption flaw in NSF decoder
https://notcve.org/view.php?id=CVE-2016-9447
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file. Los mapeos ROM en el decodificador NSF en gstreamer 0.10.x permiten a atacantes remotos provocar una denegación de servicio (lectura o escritura fuera de límites) y posiblemente ejecutar código arbitrario a través de un archivo de música NSF manipulado. A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2974.html http://rhn.redhat.com/errata/RHSA-2017-0018.html http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html http://www.openwall.com/lists/oss-security/2016/11/18/12 http://www.openwall.com/lists/oss-security/2016/11/18/13 http://www.securityfocus.com/bid/94427 https://security.gentoo.org/glsa/201705-10 https://access.redhat.com/security/cve/CVE-2016-9447 https://bugzilla.redhat.com/show& • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9636 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9636
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer. Desbordamiento de búfer basado en memoria dinámica en la función flx_decode_delta_fli en gst/flx/gstflxdec.c en el decoder FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (caída de la aplicación) proporcionando un "recuento de escritura" que va más allá del búfer inicializado. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.debian.org/security/2016/dsa-3723 http://www.debian.org/security/2016/dsa-3724 http://www.openwall.com/lists/oss-security/2016/11/24/2 http://www.securityfocus.com/bid/94499 https://bugzilla.gnome.org/show_bug.cgi?id=774834 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scaryb • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9634 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9634
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter. Desbordamiento de búfer basado en memoria dinámica en la función flx_decode_delta_fli en gst/flx/gstflxdec.c en el decoder FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (caída de la aplicación) a través del parámetro start_line. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.debian.org/security/2016/dsa-3723 http://www.debian.org/security/2016/dsa-3724 http://www.openwall.com/lists/oss-security/2016/11/24/2 http://www.securityfocus.com/bid/94499 https://bugzilla.gnome.org/show_bug.cgi?id=774834 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scaryb • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •