Red Hat Security AdvisoryRHSA-2017:0021
gstreamer1-plugins-bad-free security update
Released 2017-01-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) gstreamer1-plugins-bad-free-1.4.5-6.el7_3
- Red Hat Enterprise Linux Client Optional (v. 7) gstreamer1-plugins-bad-free-devel-1.4.5-6.el7_3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) gstreamer1-plugins-bad-free-1.4.5-6.el7_3, gstreamer1-plugins-bad-free-devel-1.4.5-6.el7_3
- Red Hat Enterprise Linux Server (v. 7) gstreamer1-plugins-bad-free-1.4.5-6.el7_3, gstreamer1-plugins-bad-free-1.4.5-6.el7_3.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) gstreamer1-plugins-bad-free-devel-1.4.5-6.el7_3, gstreamer1-plugins-bad-free-devel-1.4.5-6.el7_3.ppc
- Red Hat Enterprise Linux Workstation (v. 7) gstreamer1-plugins-bad-free-1.4.5-6.el7_3
- Red Hat Enterprise Linux Workstation Optional (v. 7) gstreamer1-plugins-bad-free-devel-1.4.5-6.el7_3
Fixes 4 records
Priority MEDIUM 41
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04843 · Published 2017-01-23 · Partial fix CWE-190
Priority LOW 39
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03539 · Published 2017-01-13 · Fixed CWE-125
Priority LOW 39
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02905 · Published 2017-01-13 · Partial fix CWE-125
Priority LOW 35
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.07903 · Published 2017-01-13 · Fixed CWE-476
THREATIST.IORead the docs