[ GLSA 201705-10 ] GStreamer plug-ins

[GLSA]

Gentoo Linux Security Advisory

Title: GStreamer plug-ins: User-assisted execution of arbitrary code (GLSA 201705-10)
Severity: normal
Exploitable: remote
Date: 2017-05-18
Bug(s): #600142, #601354
ID: 201705-10

Synopsis

Multiple vulnerabilities have been found in various GStreamer
plug-ins, the worst of which could lead to the execution of arbitrary code.


Background

The GStreamer plug-ins provide decoders to the GStreamer open source
media framework.


Affected Packages

Package: media-libs/gst-plugins-bad
Vulnerable: < 1.10.3
Unaffected: >= 1.10.3
Architectures: All supported architectures

Package: media-libs/gst-plugins-good
Vulnerable: < 1.10.3
Unaffected: >= 1.10.3
Architectures: All supported architectures

Package: media-libs/gst-plugins-base
Vulnerable: < 1.10.3
Unaffected: >= 1.10.3
Architectures: All supported architectures

Package: media-libs/gst-plugins-ugly
Vulnerable: < 1.10.3
Unaffected: >= 1.10.3
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in various GStreamer
plug-ins. Please review the CVE identifiers referenced below for details.


Impact

A remote attacker could entice a user or automated system using a
GStreamer plug-in to process a specially crafted file, resulting in the
execution of arbitrary code or a Denial of Service.


Workaround

There is no known workaround at this time.

Resolution

All gst-plugins-bad users should upgrade to the latest version: