Gstreamer
CVE-2016-9445
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
AnalysisAI
An integer overflow vulnerability exists in the vmnc decoder component of GStreamer that allows remote attackers to trigger a buffer overflow and crash the application. GStreamer version 1.10.0 is confirmed affected, with exploitation requiring no authentication or user interaction over the network. A public proof-of-concept exploit exists (published on Scary Beasts Security blog), and EPSS indicates a 2.41% probability of exploitation in the wild (85th percentile), making this a moderate real-world risk.
Technical ContextAI
This vulnerability affects the VMnc (VMware video codec) decoder plugin in GStreamer's gst-plugins-bad package, specifically in the vmncdec.c file. GStreamer is a widely-used multimedia framework for constructing graphs of media-handling components. The root cause is CWE-190 (Integer Overflow or Wraparound), where the decoder fails to properly validate large width and height values in VMnc-encoded video streams. When these dimensions are multiplied to calculate buffer sizes, an integer overflow occurs, resulting in allocation of an undersized buffer. Subsequent writes to this buffer cause a heap-based buffer overflow, leading to application crash or potential memory corruption. The affected product per CPE is cpe:2.3:a:gstreamer:gstreamer:1.10.0.
RemediationAI
Apply the upstream patch available in GStreamer's gst-plugins-bad repository (commit 4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe at https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe). For Red Hat Enterprise Linux systems, install updates per RHSA-2016-2974, RHSA-2017-0018, or RHSA-2017-0021 as appropriate for your distribution version. Gentoo users should follow GLSA-201705-10 guidance. As a temporary mitigation until patching, disable or remove the vmnc decoder plugin from GStreamer if VMware video codec support is not required, restrict processing of media files to trusted sources only, and implement network segmentation to limit exposure of systems running vulnerable GStreamer versions to untrusted network content.
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today