Detections
Analytics
Virtuozzo 7 : gstreamer-plugins-bad-free / etc (VZLSA-2017-0018)
high Nessus Plugin ID 101401
Synopsis
The remote Virtuozzo host is missing a security update.Description
An update for gstreamer-plugins-bad-free is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es) :
* An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9445)
* A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9447)
* An out-of-bounds heap read flaw was found in GStreamer's H.264 parser. A remote attacker could use this flaw to cause an application using GStreamer to crash. (CVE-2016-9809)
Note: This update removes the vulnerable Nintendo NSF plug-in.
Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected gstreamer-plugins-bad-free / etc package.See Also
Plugin Details
Severity: High
ID: 101401
File Name: Virtuozzo_VZLSA-2017-0018.nasl
Version: 1.8
Type: local
Family: Virtuozzo Local Security Checks
Published: 7/13/2017
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:virtuozzo:virtuozzo:gstreamer-plugins-bad-free, p-cpe:/a:virtuozzo:virtuozzo:gstreamer-plugins-bad-free-devel, p-cpe:/a:virtuozzo:virtuozzo:gstreamer-plugins-bad-free-devel-docs, cpe:/o:virtuozzo:virtuozzo:7
Required KB Items: Host/local_checks_enabled, Host/Virtuozzo/release, Host/Virtuozzo/rpm-list
Patch Publication Date: 1/9/2017