CVE-2016-9446
Fixed in a distro release EPSS 4%
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
Products: gstreamer, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | gst-plugins-bad | 1.10.2-2 |
| Debian 12 | gst-plugins-bad1.0 | 1.10.1-1 |
| Debian 13 | gst-plugins-bad1.0 | 1.10.1-1 |
| Debian 14 | gst-plugins-bad1.0 | 1.10.1-1 |
| Debian 7 | gst-plugins-bad0.10 | 0.10.23-7.1+deb7u3 |
| Debian 8 | gst-plugins-bad0.10 | 0.10.23-7.4+deb8u2 |
| Debian 8 | gst-plugins-bad1.0 | 1.4.4-2.1+deb8u1 |
| Red Hat Enterprise Linux 7 | clutter-gst2 | 0:2.0.18-1.el7 |
| Red Hat Enterprise Linux 7 | clutter-gst2-debuginfo | 0:2.0.18-1.el7 |
| Red Hat Enterprise Linux 7 | clutter-gst2-devel | 0:2.0.18-1.el7 |
| Red Hat Enterprise Linux 7 | gnome-video-effects | 0:0.4.3-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-bad-free | 0:0.10.23-23.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-bad-free-debuginfo | 0:0.10.23-23.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-bad-free-devel | 0:0.10.23-23.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-bad-free-devel-docs | 0:0.10.23-23.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-good | 0:0.10.31-13.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-good-debuginfo | 0:0.10.31-13.el7 |
| Red Hat Enterprise Linux 7 | gstreamer-plugins-good-devel-docs | 0:0.10.31-13.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1 | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-debuginfo | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-devel | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-devel-docs | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-bad-free | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-bad-free-debuginfo | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-bad-free-devel | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-bad-free-gtk | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-base | 0:1.10.4-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-base-debuginfo | 0:1.10.4-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-base-devel | 0:1.10.4-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-base-devel-docs | 0:1.10.4-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-base-tools | 0:1.10.4-1.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-good | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-good-debuginfo | 0:1.10.4-2.el7 |
| Red Hat Enterprise Linux 7 | orc | 0:0.4.26-1.el7 |
| Red Hat Enterprise Linux 7 | orc-compiler | 0:0.4.26-1.el7 |
| Red Hat Enterprise Linux 7 | orc-debuginfo | 0:0.4.26-1.el7 |
| Red Hat Enterprise Linux 7 | orc-devel | 0:0.4.26-1.el7 |
| Red Hat Enterprise Linux 7 | orc-doc | 0:0.4.26-1.el7 |
| SUSE Linux Enterprise Desktop 12 SP1 | gstreamer-0_10-plugins-bad | 0.10.23-19.3.4 |
| SUSE Linux Enterprise Desktop 12 SP1 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | gstreamer-0_10-plugins-bad | 0.10.23-22.5 |
| SUSE Linux Enterprise Desktop 12 SP2 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | gstreamer-plugins-bad | 1.8.3-14.1 |
| SUSE Linux Enterprise Server 12 SP1 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Server 12 SP2 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Server 12 SP2 | gstreamer-plugins-bad | 1.8.3-14.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | gstreamer-plugins-bad | 1.8.3-14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | gstreamer-plugins-bad | 1.8.3-14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | gstreamer-0_10-plugins-bad | 0.10.23-19.3.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | gstreamer-plugins-bad | 1.2.4-3.4.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | gstreamer-0_10-plugins-bad | 0.10.23-22.5 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | gstreamer-plugins-bad | 1.8.3-14.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | gstreamer-0_10-plugins-bad | 0.10.23-19.3.4 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | gstreamer-0_10-plugins-bad | 0.10.23-22.5 |
| Ubuntu 14.04 LTS | gst-plugins-bad0.10 | 0.10.23-7.2ubuntu1.3 |
| Ubuntu 14.04 LTS | gst-plugins-bad1.0 | 1.2.4-1~ubuntu1.1 |
| Ubuntu 16.04 LTS | gst-plugins-bad1.0 | 1.8.2-1ubuntu0.2 |