Synopsis

Important: gstreamer-plugins-bad-free security update

Type/Severity

Security Advisory: Important

Topic

An update for gstreamer-plugins-bad-free is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

• An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9445)
  
• A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9447)
  

Note: This updates removes the vulnerable Nintendo NSF plug-in.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64

Fixes

• BZ - 1395126 - CVE-2016-9447 gstreamer-plugins-bad-free: Memory corruption flaw in NSF decoder
• BZ - 1395767 - CVE-2016-9445 gstreamer-plugins-bad-free: Integer overflow when allocating render buffer in VMnc decoder

CVEs

• CVE-2016-9445
• CVE-2016-9447

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 6

SRPM
gstreamer-plugins-bad-free-0.10.19-5.el6_8.src.rpm	SHA-256: 14322223d0406a71594c5f9b1305dce18b2ade9b210485084b4b52e4225013f2
x86_64
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 4f541fb5765ebd5ee603a6b0e3350a9204dff78f227e01e75a05314821fe9ae4
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 07ccd5ff869650a08757351e61d12e40d6c8ea0132617b7cfefa526cca9a105f
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.x86_64.rpm	SHA-256: a1366d429fbdd4461641b4d0a8bb7b635d1be9b4873dfd03649ce67a1b2a8fae
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 96163ea93ce401533aea251767384602f98699ad241fc3103843dbd4f81409c2
i386
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.i686.rpm	SHA-256: 5ac463a77e1dc6e36836f98cd7d5df43f362300ee304534507e4466b71c1a713
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa

Red Hat Enterprise Linux Workstation 6

SRPM
gstreamer-plugins-bad-free-0.10.19-5.el6_8.src.rpm	SHA-256: 14322223d0406a71594c5f9b1305dce18b2ade9b210485084b4b52e4225013f2
x86_64
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 4f541fb5765ebd5ee603a6b0e3350a9204dff78f227e01e75a05314821fe9ae4
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 07ccd5ff869650a08757351e61d12e40d6c8ea0132617b7cfefa526cca9a105f
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.x86_64.rpm	SHA-256: a1366d429fbdd4461641b4d0a8bb7b635d1be9b4873dfd03649ce67a1b2a8fae
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 96163ea93ce401533aea251767384602f98699ad241fc3103843dbd4f81409c2
i386
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.i686.rpm	SHA-256: 5ac463a77e1dc6e36836f98cd7d5df43f362300ee304534507e4466b71c1a713
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa

Red Hat Enterprise Linux Desktop 6

SRPM
gstreamer-plugins-bad-free-0.10.19-5.el6_8.src.rpm	SHA-256: 14322223d0406a71594c5f9b1305dce18b2ade9b210485084b4b52e4225013f2
x86_64
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 4f541fb5765ebd5ee603a6b0e3350a9204dff78f227e01e75a05314821fe9ae4
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 0ffb69a8a652afe1cae40208c6a537d7a9faa546947f5fbe4843948f6a429287
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 07ccd5ff869650a08757351e61d12e40d6c8ea0132617b7cfefa526cca9a105f
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.x86_64.rpm	SHA-256: a1366d429fbdd4461641b4d0a8bb7b635d1be9b4873dfd03649ce67a1b2a8fae
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.x86_64.rpm	SHA-256: 96163ea93ce401533aea251767384602f98699ad241fc3103843dbd4f81409c2
i386
gstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpm	SHA-256: fa421fdb1dd6955c25c3159e4509a90f3f477f2314b49639ac657838915b4362
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.i686.rpm	SHA-256: be58888a69848ba89271b092e149d688acae85341616d1f133da705de9fc81d1
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpm	SHA-256: 8aa4c9dc06965872b578aaa6608b5642725268c16078e63078cbf9dcf807d7af
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.i686.rpm	SHA-256: 5ac463a77e1dc6e36836f98cd7d5df43f362300ee304534507e4466b71c1a713
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpm	SHA-256: e7c29c9bc2016a48a4e38fb7502f04b44f587e303b71d45f07c01523266287fa

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
gstreamer-plugins-bad-free-0.10.19-5.el6_8.src.rpm	SHA-256: 14322223d0406a71594c5f9b1305dce18b2ade9b210485084b4b52e4225013f2
s390x
gstreamer-plugins-bad-free-0.10.19-5.el6_8.s390.rpm	SHA-256: 33d6aef985039bce3a63729bff3110f13b0247b7292a212065e302b114dff29f
gstreamer-plugins-bad-free-0.10.19-5.el6_8.s390x.rpm	SHA-256: 7a5a62e38435299ddf55ec3973d040fb6c0fa802cf6024f1cff2421886ae0d19
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.s390.rpm	SHA-256: 892e64c6cb6df4d18c8030a7da038251a75e6d98d1bb9ce9eed24df3a0de171f
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.s390.rpm	SHA-256: 892e64c6cb6df4d18c8030a7da038251a75e6d98d1bb9ce9eed24df3a0de171f
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.s390x.rpm	SHA-256: ddeb497ccfaee28489928d91434c7b4c0b89e50775f71ed9ab8f988a87db2f56
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.s390x.rpm	SHA-256: ddeb497ccfaee28489928d91434c7b4c0b89e50775f71ed9ab8f988a87db2f56
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.s390.rpm	SHA-256: a70957cfb20e68e705b79102b126f5f7eebe796d820ca89735fde1a461044f32
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.s390x.rpm	SHA-256: b54d877f9164d7b941d62ebedbb60db4ff28f59a6a01144268f58c7605c6168f
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.s390x.rpm	SHA-256: 9809ee71583a98dfb9b26d042a14ec0c3fcf57b57f7141241ac69692858b43bf
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.s390.rpm	SHA-256: 5d92fcaf55c2ba6f51efbbbd2d4c7fc201154f117863e6de1ff39695f0aaf2cb
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.s390x.rpm	SHA-256: c271c4b82cf06ac2df3d0e3baf9a3972bce96b2b6f0fd7cd7d07ee60acc7e293

Red Hat Enterprise Linux for Power, big endian 6

SRPM
gstreamer-plugins-bad-free-0.10.19-5.el6_8.src.rpm	SHA-256: 14322223d0406a71594c5f9b1305dce18b2ade9b210485084b4b52e4225013f2
ppc64
gstreamer-plugins-bad-free-0.10.19-5.el6_8.ppc.rpm	SHA-256: a90b1306012bef58cc0385de183dc3b0dad2bef2652f6fbca4c56faf76c30bc0
gstreamer-plugins-bad-free-0.10.19-5.el6_8.ppc64.rpm	SHA-256: e8d0ed64daaafdad4d69aa931fc4e5ac6bb721008e9d26b14fc54db9fb2ef958
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.ppc.rpm	SHA-256: b91cd0aea495008622c0e6cb6d011b8cd3af39861933691919e62c695e1bc90c
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.ppc.rpm	SHA-256: b91cd0aea495008622c0e6cb6d011b8cd3af39861933691919e62c695e1bc90c
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.ppc64.rpm	SHA-256: 0abb2a74c647fb6ef8757612b8c5e0bbbfc095ffc37f322d399533f8800982d9
gstreamer-plugins-bad-free-debuginfo-0.10.19-5.el6_8.ppc64.rpm	SHA-256: 0abb2a74c647fb6ef8757612b8c5e0bbbfc095ffc37f322d399533f8800982d9
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.ppc.rpm	SHA-256: c11c1bd685d34ab214d64a3bbeb950ff05233d55cb7dc802d611cb26dba833c3
gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.ppc64.rpm	SHA-256: 0dfd73a3e49bb47e4ed719d9d3878bf9b7fb1f7abf527a3279764705e3bedd1a
gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.ppc64.rpm	SHA-256: 0567e1354398c903e8b92b07c61c1f7d8c9f71ff48f446f4b48da109dbcfac9a
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.ppc.rpm	SHA-256: ff6af7c6e42c414f465844100b831f96e428afe2199c962bdebf59f9c455cd7b
gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.ppc64.rpm	SHA-256: ada794493fce518b1ae4a9c8455653ffdd2dc1ea024a1fd789cd1b079a2cce4c