Executive brief
GStreamer is a widely used multimedia framework for processing audio and video. A vulnerability in its FLIC video decoder allows an attacker to crash applications using the library by providing a specially crafted, invalid video file. This results in a denial of service, potentially impacting media players or web browsers that rely on GStreamer for playback.
Technical details
A vulnerability exists in the gst_decode_chain_free_internal function within the flxdec decoder of GStreamer's gst-plugins-good. The root cause is an incorrect unref call where the decoder attempts to unreference a parent object it does not own, leading to an invalid memory read and subsequent crash. An attacker can exploit this by providing a malformed FLIC file to an application using GStreamer. This issue is resolved in GStreamer version 1.10.2.
Affected products
- GStreamer gst-plugins-good before 1.10.2
Timeline
- 2016-11-23: patched: Issue resolved in upstream git master
- 2016-12-01: disclosed: Public disclosure on oss-security mailing list
- 2017-01-13: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2016/12/01/2
- http://www.openwall.com/lists/oss-security/2016/12/05/8
- http://www.securityfocus.com/bid/95163
- https://access.redhat.com/errata/RHSA-2017:2060
- https://bugzilla.gnome.org/show_bug.cgi?id=774897
- https://gstreamer.freedesktop.org/releases/1.10/
- https://security.gentoo.org/glsa/201705-10