Arch Linux Security Advisory ASA-201701-3 ========================================= Severity: High Date : 2017-01-02 CVE-ID : CVE-2016-9445 CVE-2016-9446 Package : gst-plugins-bad Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-76 Summary ======= The package gst-plugins-bad before version 1.10.2-2 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.10.2-2. # pacman -Syu "gst-plugins-bad>=1.10.2-2" The problems have been fixed upstream in version 1.10.2. Workaround ========== None Description =========== - CVE-2016-9445 (arbitrary code execution) The vmnc decoder in gst-plugins-bad of the gstreamer code base contains a width * height * depth integer overflow in the allocation of the render buffer inside gst/vmnc/vmncdec.c. - CVE-2016-9446 (information disclosure) An information disclosure vulnerability has been discovered in the render canvas functionality of gst-plugins-bad due to the lack of initializing the returned heap area of g_malloc(). An example for the information leak would be thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas at all. This could be a problem for anyone using gstreamer in a server environment to provide a thumbnailing services. Impact ====== An attacker is able to provide a crafted VMNC file that would allow for either arbitrary code execution or disclose information of the memory of the running host. References ========== http://www.openwall.com/lists/oss-security/2016/11/18/13 https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisio... https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncd... https://bugzilla.gnome.org/show_bug.cgi?id=774533 https://security.archlinux.org/CVE-2016-9445 https://security.archlinux.org/CVE-2016-9446