Vulnerabilities > CVE-2016-9813 - NULL Pointer Dereference vulnerability in Gstreamer

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
gstreamer
CWE-476
nessus
exploit available

Summary

The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

Vulnerable Configurations

Part Description Count
Application
Gstreamer
1

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionGStreamer gst-plugins-bad Plugin - NULL Pointer Dereference. CVE-2016-9813. Dos exploit for Linux platform
fileexploits/linux/dos/42162.txt
idEDB-ID:42162
last seen2017-06-13
modified2017-06-12
platformlinux
port
published2017-06-12
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/42162/
titleGStreamer gst-plugins-bad Plugin - NULL Pointer Dereference
typedos

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201705-10.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201705-10 (GStreamer plug-ins: User-assisted execution of arbitrary code) Multiple vulnerabilities have been discovered in various GStreamer plug-ins. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated system using a GStreamer plug-in to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id100263
    published2017-05-18
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100263
    titleGLSA-201705-10 : GStreamer plug-ins: User-assisted execution of arbitrary code
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3818.NASL
    descriptionHanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened.
    last seen2020-06-01
    modified2020-06-02
    plugin id99004
    published2017-03-28
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99004
    titleDebian DSA-3818-1 : gst-plugins-bad1.0 - security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3296-1.NASL
    descriptionThis update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes : - Check an integer overflow (CVE-2016-9445) and initialize a buffer (CVE-2016-9446) in vmncdec. (bsc#1010829) - CVE-2016-9809: Ensure codec_data has the right size when reading number of SPS (bsc#1013659). - CVE-2016-9812: Add more section size checks (bsc#1013678). - CVE-2016-9813: fix PAT parsing (bsc#1013680). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96258
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96258
    titleSUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3296-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0021.NASL
    descriptionAn update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es) : * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-06-01
    modified2020-06-02
    plugin id96342
    published2017-01-10
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96342
    titleCentOS 7 : gstreamer1-plugins-bad-free (CESA-2017:0021)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0021.NASL
    descriptionFrom Red Hat Security Advisory 2017:0021 : An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es) : * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-06-01
    modified2020-06-02
    plugin id96329
    published2017-01-06
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96329
    titleOracle Linux 7 : gstreamer1-plugins-bad-free (ELSA-2017-0021)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-0021.NASL
    descriptionAn update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es) : * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-06-01
    modified2020-06-02
    plugin id101404
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101404
    titleVirtuozzo 7 : gstreamer1-plugins-bad-free / etc (VZLSA-2017-0021)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-84.NASL
    descriptionThis update for gstreamer-plugins-bad fixes the following issues : - CVE-2016-9809: Off by one read in gst_h264_parse_set_caps() (bsc#1013659). - CVE-2016-9812: Out of bounds read in gst_mpegts_section_new (bsc#1013678). - CVE-2016-9813: mpegts parser: NULL pointer deref in _parse_pat (bsc#1013680).
    last seen2020-06-05
    modified2017-01-17
    plugin id96550
    published2017-01-17
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96550
    titleopenSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-84)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1007.NASL
    descriptionAccording to the versions of the gstreamer1-plugins-bad-free package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-05-06
    modified2017-05-01
    plugin id99853
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99853
    titleEulerOS 2.0 SP2 : gstreamer1-plugins-bad-free (EulerOS-SA-2017-1007)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1008.NASL
    descriptionAccording to the versions of the gstreamer1-plugins-bad-free package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-05-06
    modified2017-05-01
    plugin id99854
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99854
    titleEulerOS 2.0 SP1 : gstreamer1-plugins-bad-free (EulerOS-SA-2017-1008)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-63.NASL
    descriptionThis update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes : - Check an integer overflow (CVE-2016-9445) and initialize a buffer (CVE-2016-9446) in vmncdec. (bsc#1010829) - CVE-2016-9809: Ensure codec_data has the right size when reading number of SPS (bsc#1013659). - CVE-2016-9812: Add more section size checks (bsc#1013678). - CVE-2016-9813: fix PAT parsing (bsc#1013680). This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen2020-06-05
    modified2017-01-10
    plugin id96382
    published2017-01-10
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96382
    titleopenSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-63)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3297-1.NASL
    descriptionThis update for gstreamer-plugins-bad fixes the following issues : - CVE-2016-9809: Malicious mkv/h264 file could cause an off by one out of bounds read and lead to crash (bsc#1013659) - CVE-2016-9812: Malicious mpeg file could cause invalid a NULL pointer access and lead to crash (bsc#1013678) - CVE-2016-9813: Malicious mpegts file could cause invalid a NULL pointer access and lead to crash (bsc#1013680) - CVE-2016-9445, CVE-2016-9446: Check an integer overflow and initialize a buffer in vmncdec (bsc#1010829) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96259
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96259
    titleSUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3297-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-94.NASL
    descriptionThis update for gstreamer-plugins-bad fixes the following issues : - CVE-2016-9809: Off by one read in gst_h264_parse_set_caps() (bsc#1013659). - CVE-2016-9812: Out of bounds read in gst_mpegts_section_new (bsc#1013678). - CVE-2016-9813: mpegts parser: NULL pointer deref in _parse_pat (bsc#1013680).
    last seen2020-06-05
    modified2017-01-17
    plugin id96558
    published2017-01-17
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96558
    titleopenSUSE Security Update : gstreamer-plugins-bad (openSUSE-2017-94)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0021.NASL
    descriptionAn update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es) : * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-06-01
    modified2020-06-02
    plugin id96313
    published2017-01-05
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96313
    titleRHEL 7 : gstreamer1-plugins-bad-free (RHSA-2017:0021)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170105_GSTREAMER1_PLUGINS_BAD_FREE_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer
    last seen2020-03-18
    modified2017-01-06
    plugin id96330
    published2017-01-06
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96330
    titleScientific Linux Security Update : gstreamer1-plugins-bad-free on SL7.x x86_64 (20170105)

Redhat

advisories
bugzilla
id1401934
titleCVE-2016-9813 gstreamer-plugins-bad-free: NULL pointer dereference in mpegts parser
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentgstreamer1-plugins-bad-free-devel is earlier than 0:1.4.5-6.el7_3
          ovaloval:com.redhat.rhsa:tst:20170021001
        • commentgstreamer1-plugins-bad-free-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20170021002
      • AND
        • commentgstreamer1-plugins-bad-free is earlier than 0:1.4.5-6.el7_3
          ovaloval:com.redhat.rhsa:tst:20170021003
        • commentgstreamer1-plugins-bad-free is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20170021004
rhsa
idRHSA-2017:0021
released2017-01-05
severityModerate
titleRHSA-2017:0021: gstreamer1-plugins-bad-free security update (Moderate)
rpms
  • gstreamer1-plugins-bad-free-0:1.4.5-6.el7_3
  • gstreamer1-plugins-bad-free-debuginfo-0:1.4.5-6.el7_3
  • gstreamer1-plugins-bad-free-devel-0:1.4.5-6.el7_3