Security update for gstreamer-plugins-base SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0161-1 Final 1 1 2017-01-16T14:38:55Z current 2017-01-16T14:38:55Z 2017-01-16T14:38:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gstreamer-plugins-base This update for gstreamer-plugins-base fixes the following issue: - CVE-2016-9811: out of bounds memory read in windows_icon_typefind (bsc#1013669) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-updates/2017-01/msg00093.html E-Mail link for openSUSE-SU-2017:0161-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 gstreamer-plugins-base-1.4.3-3.1 gstreamer-plugins-base-32bit-1.4.3-3.1 gstreamer-plugins-base-debuginfo-1.4.3-3.1 gstreamer-plugins-base-debuginfo-32bit-1.4.3-3.1 gstreamer-plugins-base-debugsource-1.4.3-3.1 gstreamer-plugins-base-devel-1.4.3-3.1 gstreamer-plugins-base-doc-1.4.3-3.1 gstreamer-plugins-base-lang-1.4.3-3.1 libgstallocators-1_0-0-1.4.3-3.1 libgstallocators-1_0-0-32bit-1.4.3-3.1 libgstallocators-1_0-0-debuginfo-1.4.3-3.1 libgstallocators-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstapp-1_0-0-1.4.3-3.1 libgstapp-1_0-0-32bit-1.4.3-3.1 libgstapp-1_0-0-debuginfo-1.4.3-3.1 libgstapp-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstaudio-1_0-0-1.4.3-3.1 libgstaudio-1_0-0-32bit-1.4.3-3.1 libgstaudio-1_0-0-debuginfo-1.4.3-3.1 libgstaudio-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstfft-1_0-0-1.4.3-3.1 libgstfft-1_0-0-32bit-1.4.3-3.1 libgstfft-1_0-0-debuginfo-1.4.3-3.1 libgstfft-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstpbutils-1_0-0-1.4.3-3.1 libgstpbutils-1_0-0-32bit-1.4.3-3.1 libgstpbutils-1_0-0-debuginfo-1.4.3-3.1 libgstpbutils-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstriff-1_0-0-1.4.3-3.1 libgstriff-1_0-0-32bit-1.4.3-3.1 libgstriff-1_0-0-debuginfo-1.4.3-3.1 libgstriff-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstrtp-1_0-0-1.4.3-3.1 libgstrtp-1_0-0-32bit-1.4.3-3.1 libgstrtp-1_0-0-debuginfo-1.4.3-3.1 libgstrtp-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstrtsp-1_0-0-1.4.3-3.1 libgstrtsp-1_0-0-32bit-1.4.3-3.1 libgstrtsp-1_0-0-debuginfo-1.4.3-3.1 libgstrtsp-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstsdp-1_0-0-1.4.3-3.1 libgstsdp-1_0-0-32bit-1.4.3-3.1 libgstsdp-1_0-0-debuginfo-1.4.3-3.1 libgstsdp-1_0-0-debuginfo-32bit-1.4.3-3.1 libgsttag-1_0-0-1.4.3-3.1 libgsttag-1_0-0-32bit-1.4.3-3.1 libgsttag-1_0-0-debuginfo-1.4.3-3.1 libgsttag-1_0-0-debuginfo-32bit-1.4.3-3.1 libgstvideo-1_0-0-1.4.3-3.1 libgstvideo-1_0-0-32bit-1.4.3-3.1 libgstvideo-1_0-0-debuginfo-1.4.3-3.1 libgstvideo-1_0-0-debuginfo-32bit-1.4.3-3.1 typelib-1_0-GstAllocators-1_0-1.4.3-3.1 typelib-1_0-GstApp-1_0-1.4.3-3.1 typelib-1_0-GstAudio-1_0-1.4.3-3.1 typelib-1_0-GstFft-1_0-1.4.3-3.1 typelib-1_0-GstPbutils-1_0-1.4.3-3.1 typelib-1_0-GstRiff-1_0-1.4.3-3.1 typelib-1_0-GstRtp-1_0-1.4.3-3.1 typelib-1_0-GstRtsp-1_0-1.4.3-3.1 typelib-1_0-GstSdp-1_0-1.4.3-3.1 typelib-1_0-GstTag-1_0-1.4.3-3.1 typelib-1_0-GstVideo-1_0-1.4.3-3.1 gstreamer-plugins-base-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-32bit-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-debugsource-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-devel-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-doc-1.4.3-3.1 as a component of openSUSE 13.2 gstreamer-plugins-base-lang-1.4.3-3.1 as a component of openSUSE 13.2 libgstallocators-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstallocators-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstallocators-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstallocators-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstapp-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstapp-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstapp-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstapp-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstaudio-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstaudio-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstaudio-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstaudio-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstfft-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstfft-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstfft-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstfft-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstpbutils-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstpbutils-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstpbutils-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstpbutils-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstriff-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstriff-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstriff-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstriff-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtp-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtp-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtp-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtp-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtsp-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtsp-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtsp-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstrtsp-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstsdp-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstsdp-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstsdp-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstsdp-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgsttag-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgsttag-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgsttag-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgsttag-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstvideo-1_0-0-1.4.3-3.1 as a component of openSUSE 13.2 libgstvideo-1_0-0-32bit-1.4.3-3.1 as a component of openSUSE 13.2 libgstvideo-1_0-0-debuginfo-1.4.3-3.1 as a component of openSUSE 13.2 libgstvideo-1_0-0-debuginfo-32bit-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstAllocators-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstApp-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstAudio-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstFft-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstPbutils-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstRiff-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstRtp-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstRtsp-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstSdp-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstTag-1_0-1.4.3-3.1 as a component of openSUSE 13.2 typelib-1_0-GstVideo-1_0-1.4.3-3.1 as a component of openSUSE 13.2 The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. CVE-2016-9811 openSUSE 13.2:gstreamer-plugins-base-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-32bit-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-debuginfo-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-debugsource-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-devel-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-doc-1.4.3-3.1 openSUSE 13.2:gstreamer-plugins-base-lang-1.4.3-3.1 openSUSE 13.2:libgstallocators-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstallocators-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstallocators-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstallocators-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstapp-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstapp-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstapp-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstapp-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstaudio-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstaudio-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstaudio-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstaudio-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstfft-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstfft-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstfft-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstfft-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstpbutils-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstpbutils-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstpbutils-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstpbutils-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstriff-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstriff-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstriff-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstriff-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstrtp-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstrtp-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstrtp-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstrtp-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstrtsp-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstrtsp-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstrtsp-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstrtsp-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstsdp-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstsdp-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstsdp-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstsdp-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgsttag-1_0-0-1.4.3-3.1 openSUSE 13.2:libgsttag-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgsttag-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgsttag-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:libgstvideo-1_0-0-1.4.3-3.1 openSUSE 13.2:libgstvideo-1_0-0-32bit-1.4.3-3.1 openSUSE 13.2:libgstvideo-1_0-0-debuginfo-1.4.3-3.1 openSUSE 13.2:libgstvideo-1_0-0-debuginfo-32bit-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstAllocators-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstApp-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstAudio-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstFft-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstPbutils-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstRiff-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstRtp-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstRtsp-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstSdp-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstTag-1_0-1.4.3-3.1 openSUSE 13.2:typelib-1_0-GstVideo-1_0-1.4.3-3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-updates/2017-01/msg00093.html https://www.suse.com/security/cve/CVE-2016-9811.html CVE-2016-9811 https://bugzilla.suse.com/1013669 SUSE Bug 1013669