CVE-2016-9811: Medium severity GStreamer GStreamer vulnerability
An out-of-bounds heap read was found in windowsicontypefind.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=774902
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/2fdccfd64fc609e44e9c4b8eed5bfdc0ab9c9095
CVE assignment:
http://seclists.org/oss-sec/2016/q4/589
Other sources
The windowsicontypefind function in gst-plugins-base in GStreamer before 1.10.2, when GSLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9811?
CVE-2016-9811 is classified as a medium severity vulnerability due to its potential to cause denial of service through out-of-bounds reads.
How do I fix CVE-2016-9811?
To mitigate CVE-2016-9811, upgrade GStreamer to version 1.10.2 or later.
What systems are affected by CVE-2016-9811?
CVE-2016-9811 affects GStreamer versions before 1.10.2, particularly in multiple Linux distributions like Red Hat, Fedora, and Debian.
What impact does CVE-2016-9811 have?
Exploitation of CVE-2016-9811 can lead to a denial of service by causing out-of-bounds heap reads.
Is there a public exploit for CVE-2016-9811?
At this time, there is no widely known public exploit for CVE-2016-9811, but attackers could potentially craft malicious files to trigger the vulnerability.