Junglewise Threat Intelligence

CVE-2016-9809: GStreamer off-by-one error in H.264 parser

CVE-2016-9809 · Severity: high · CVSS 7.8 · Published 2017-01-13

Technologies: Gstreamer, Red Hat Gstreamer-Plugins-Bad-Free. Vendors: Gstreamer, Debian, Red Hat.

Executive brief

GStreamer, a widely used multimedia framework for processing audio and video, contains a vulnerability in its H.264 video parsing component. An attacker can exploit this by providing a specially crafted video file that, when opened by a user, causes the application to crash or potentially leak sensitive information. This affects various Linux distributions and any software relying on GStreamer for media playback.

Technical details

An off-by-one error exists in the 'gst_h264_parse_set_caps' function within GStreamer's H.264 parsing component. The vulnerability is triggered when the parser processes a malformed H.264 stream, leading to an out-of-bounds read. While primarily identified as a cause for application crashes (Denial of Service), out-of-bounds reads can sometimes be leveraged for information disclosure or, in complex scenarios, memory corruption. The attack vector requires a user to open a crafted file (User Interaction) using an application linked against the vulnerable GStreamer library. The issue was addressed in GStreamer version 1.10.2.

Affected products

  • GStreamer GStreamer before 1.10.2
  • Red Hat gstreamer-plugins-bad-free Enterprise Linux 7
  • Debian gst-plugins-bad1.0 8 (jessie)

Timeline

  • 2016-12-01: disclosed: Initial public disclosure on oss-security mailing list
  • 2017-01-05: patched: Red Hat released security updates (RHSA-2017:0018, RHSA-2017:0021)
  • 2017-01-13: advisory: NVD published CVE-2016-9809
  • 2017-03-27: patched: Debian released security update (DSA-3818-1)

References

Related threats