Junglewise Threat Intelligence

CVE-2016-9811: GStreamer gst-plugins-base out-of-bounds read in windows_icon_typefind

CVE-2016-9811 · Severity: medium · CVSS 4.7 · Published 2017-01-13

Vendors: Gstreamer.

Executive brief

GStreamer is a widely used multimedia framework that allows applications to process audio and video. A vulnerability in its icon processing component could allow a specially crafted image file to crash applications using the library. This could lead to a denial of service, impacting the reliability of media players or other software that handles user-provided media files.

Technical details

An out-of-bounds read vulnerability exists in the 'windows_icon_typefind' function within the gst-plugins-base package of GStreamer. The flaw is triggered when the library processes a maliciously crafted .ico file, specifically when the G_SLICE environment variable is set to 'always-malloc'. An attacker can exploit this by providing a malformed icon file to an application using GStreamer, leading to a 4-byte heap out-of-bounds read. This typically results in an application crash (denial of service). The issue was addressed in GStreamer version 1.10.2.

Affected products

  • GStreamer gst-plugins-base before 1.10.2

Timeline

  • 2016-12-01: disclosed: Public disclosure on oss-security mailing list
  • 2016-12-01: patched: Fixed in GStreamer 1.10.2 release
  • 2017-01-13: advisory: NVD publication date

References