CVE-2016-9635: GStreamer heap buffer overflow in FLIC decoder

CVE-2016-9635 · Severity: critical · CVSS 9.8 · Published 2017-01-27

GStreamer is a widely used multimedia framework that allows applications to play and process video and audio files. A vulnerability in its FLIC video decoder allows a remote attacker to crash applications or potentially take control of a system by providing a specially crafted media file. This could lead to unauthorized access to user data or a complete system compromise if a user opens a malicious video file.

Technologies: Debian Linux, Gstreamer, Red Hat GStreamer Plugins Good, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation. Vendors: Debian, Gstreamer, Red Hat, Redhat.

Quick answers

Is CVE-2016-9635 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-9635 being exploited in the wild.
How severe is CVE-2016-9635?
Critical severity, with a CVSS score of 9.8, published 27 January 2017.
Which products and versions are affected?
GStreamer GStreamer before 1.10.2; Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7; Debian Space debian_linux 8.0.
Is there a fix for CVE-2016-9635?
A patch was published on 2016-12-21: Red Hat released security updates for RHEL 6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9635 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-9635?
Check whether you run Debian Linux, Gstreamer, Red Hat GStreamer Plugins Good or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered when the decoder processes a 'skip count' value that exceeds the bounds of the initialized destination buffer. A remote, unauthenticated attacker can exploit this by providing a malicious FLIC (.fli/.flc) media file to an application using the GStreamer library. Successful exploitation can lead to arbitrary code execution in the context of the user running the application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2; some distributions like Red Hat opted to remove the vulnerable plugin entirely as a remediation.

Affected products

  • GStreamer GStreamer before 1.10.2
  • Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
  • Debian Space debian_linux 8.0

Timeline

  • 2016-11-24: disclosed: Public disclosure via oss-security mailing list
  • 2016-12-21: patched: Red Hat released security updates for RHEL 6
  • 2017-01-05: patched: Red Hat released security updates for RHEL 7
  • 2017-01-27: advisory: NVD published CVE-2016-9635

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.