CVE-2016-9447
gstreamer-plugins-bad-free: Memory corruption flaw in NSF decoder
Severity Score
7.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
Los mapeos ROM en el decodificador NSF en gstreamer 0.10.x permiten a atacantes remotos provocar una denegación de servicio (lectura o escritura fuera de límites) y posiblemente ejecutar código arbitrario a través de un archivo de música NSF manipulado.
A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix: An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-11-18 CVE Reserved
- 2016-12-21 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
- CWE-787: Out-of-bounds Write
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html | X_refsource_misc | |
| http://www.openwall.com/lists/oss-security/2016/11/18/12 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/11/18/13 | Mailing List |
|
| http://www.securityfocus.com/bid/94427 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2974.html | 2023-11-07 | |
| http://rhn.redhat.com/errata/RHSA-2017-0018.html | 2023-11-07 | |
| https://security.gentoo.org/glsa/201705-10 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2016-9447 | 2017-01-05 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1395126 | 2017-01-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.0 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.0" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.1 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.1" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.2 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.2" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.3 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.3" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.4 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.4" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.5 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.5" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.6 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.6" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.7 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.7" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.8 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.8" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.9 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.9" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.10 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.10" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.11 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.11" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.12 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.12" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.13 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.13" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.14 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.14" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.15 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.15" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.16 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.16" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.17 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.17" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.18 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.18" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.19 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.19" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.20 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.20" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.21 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.21" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.22 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.22" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.23 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.23" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.24 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.24" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.25 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.25" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.26 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.26" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.27 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.27" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.28 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.28" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.29 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.29" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.30 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.30" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.31 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.31" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.32 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.32" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.33 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.33" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.34 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.34" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.35 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.35" | - |
Affected
| ||||||
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | 0.10.36 Search vendor "Gstreamer Project" for product "Gstreamer" and version "0.10.36" | - |
Affected
| ||||||