Executive brief
GStreamer is a widely used multimedia framework that allows applications to play and process video and audio files. A vulnerability in its FLIC video decoder allows a remote attacker to crash applications or potentially take control of a system by providing a specially crafted media file. This could lead to unauthorized access to user data or a complete system compromise if a user opens a malicious video file.
Technical details
A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered when the decoder processes a 'skip count' value that exceeds the bounds of the initialized destination buffer. A remote, unauthenticated attacker can exploit this by providing a malicious FLIC (.fli/.flc) media file to an application using the GStreamer library. Successful exploitation can lead to arbitrary code execution in the context of the user running the application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2; some distributions like Red Hat opted to remove the vulnerable plugin entirely as a remediation.
Affected products
- GStreamer GStreamer before 1.10.2
- Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
- Debian Space debian_linux 8.0
Timeline
- 2016-11-24: disclosed: Public disclosure via oss-security mailing list
- 2016-12-21: patched: Red Hat released security updates for RHEL 6
- 2017-01-05: patched: Red Hat released security updates for RHEL 7
- 2017-01-27: advisory: NVD published CVE-2016-9635
References
- http://rhn.redhat.com/errata/RHSA-2016-2975.html
- http://rhn.redhat.com/errata/RHSA-2017-0019.html
- http://rhn.redhat.com/errata/RHSA-2017-0020.html
- http://www.debian.org/security/2016/dsa-3723
- http://www.debian.org/security/2016/dsa-3724
- http://www.openwall.com/lists/oss-security/2016/11/24/2
- http://www.securityfocus.com/bid/94499