CVE-2016-9811 — Out-of-bounds Read in Gstreamer

CWE-125 — Out-of-bounds Read13 documents8 sources
Severity
4.7MEDIUMNVD
EPSS
0.5%
top 34.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
GstreamerDebian LinuxFedoraproject Fedora+6 more
Timeline
PublishedJan 13
Latest updateMay 13

Description

The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages4 packages

Also affects: Debian Linux 8.0, 9.0, Fedora 35, Enterprise Linux 7.4, 7.5, 7.6, 7.7

🔴Vulnerability Details

3
GHSA
GHSA-f9mv-78h4-x2jx: The windows_icon_typefind function in gst-plugins-base in GStreamer before 1↗2022-05-13
▶
OSV
CVE-2016-9811: The windows_icon_typefind function in gst-plugins-base in GStreamer before 1↗2017-01-13
▶
CVEList
CVE-2016-9811: The windows_icon_typefind function in gst-plugins-base in GStreamer before 1↗2017-01-13
▶

📋Vendor Advisories

3
Ubuntu
GStreamer Base Plugins vulnerabilities↗2017-03-27
▶
Red Hat
gstreamer: Out of bounds heap read in windows_icon_typefind↗2016-11-23
▶
Debian
CVE-2016-9811: gst-plugins-base1.0 - The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10....↗2016
▶

💬Community

6
Bugzilla
CVE-2016-9811 gstreamer1-plugins-base: gstreamer: Out of bounds heap read in windows_icon_typefind [fedora-all]↗2016-12-06
▶
Bugzilla
CVE-2016-9811 mingw-gstreamer1-plugins-base: gstreamer: Out of bounds heap read in windows_icon_typefind [fedora-all]↗2016-12-06
▶
Bugzilla
CVE-2016-9811 mingw-gstreamer-plugins-base: gstreamer: Out of bounds heap read in windows_icon_typefind [fedora-all]↗2016-12-06
▶
Bugzilla
CVE-2016-9811 gstreamer-plugins-base: gstreamer: Out of bounds heap read in windows_icon_typefind [fedora-all]↗2016-12-06
▶
Bugzilla
CVE-2016-9811 gstreamer: Out of bounds heap read in windows_icon_typefind↗2016-12-06
▶
CVE-2016-9811 — Out-of-bounds Read in Gstreamer | cvebase