CVE-2016-9446: High severity Gstreamer Project Gstreamer vulnerability
A missing initialization of allocated heap memory for render canvas leads to information leak.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/462
External References:
https://scarybeastsecurity.blogspot.sk/2016/11/0day-poc-risky-design-decisions-in.html
Other sources
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9446?
CVE-2016-9446 has been assigned a severity rating that indicates a moderate risk due to potential information leakage.
How do I fix CVE-2016-9446?
To fix CVE-2016-9446, upgrade to GStreamer version 1.11.1 or later, as it addresses the initialization issue.
What types of systems are affected by CVE-2016-9446?
CVE-2016-9446 affects GStreamer versions prior to 1.11.1 and various Red Hat Enterprise Linux versions including 7.0, 7.4, 7.5, 7.6, and 7.7.
What causes the vulnerability in CVE-2016-9446?
CVE-2016-9446 is caused by a missing initialization of allocated heap memory for the render canvas, leading to potential information leakage.
What are the potential impacts of CVE-2016-9446?
The potential impacts of CVE-2016-9446 include unauthorized access to sensitive data through the exposure of uninitialized memory.