CVE-2016-9634
9.8
CRITICAL · CVSS 3.0 · EPSS 8.9% (pctl 95)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 8.91% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-01-27 |
| Last modified | 2026-06-17 |
Affected (6)
| Vendor | Product |
|---|---|
| debian | debian linux |
| gstreamer | gstreamer |
| redhat | enterprise linux desktop |
| redhat | enterprise linux hpc node |
| redhat | enterprise linux server |
| redhat | enterprise linux workstation |
References
- http://rhn.redhat.com/errata/RHSA-2016-2975.html
- http://rhn.redhat.com/errata/RHSA-2017-0019.html
- http://rhn.redhat.com/errata/RHSA-2017-0020.html
- http://www.debian.org/security/2016/dsa-3723
- http://www.debian.org/security/2016/dsa-3724
- http://www.openwall.com/lists/oss-security/2016/11/24/2
- http://www.securityfocus.com/bid/94499
- https://bugzilla.gnome.org/show_bug.cgi?id=774834
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
- https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-advancing-exploitation.html
- https://security.gentoo.org/glsa/201705-10
- http://rhn.redhat.com/errata/RHSA-2016-2975.html
- http://rhn.redhat.com/errata/RHSA-2017-0019.html
- http://rhn.redhat.com/errata/RHSA-2017-0020.html
- http://www.debian.org/security/2016/dsa-3723
- http://www.debian.org/security/2016/dsa-3724
- http://www.openwall.com/lists/oss-security/2016/11/24/2
- http://www.securityfocus.com/bid/94499
- https://bugzilla.gnome.org/show_bug.cgi?id=774834
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
→ the Explorer · watch your stack · NVD