7.8

CVE-2016-9447

The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gstreamer ≫ Gstreamer Version 0.10.0
Gstreamer ≫ Gstreamer Version 0.10.1
Gstreamer ≫ Gstreamer Version 0.10.2
Gstreamer ≫ Gstreamer Version 0.10.3
Gstreamer ≫ Gstreamer Version 0.10.4
Gstreamer ≫ Gstreamer Version 0.10.5
Gstreamer ≫ Gstreamer Version 0.10.6
Gstreamer ≫ Gstreamer Version 0.10.7
Gstreamer ≫ Gstreamer Version 0.10.8
Gstreamer ≫ Gstreamer Version 0.10.9
Gstreamer ≫ Gstreamer Version 0.10.10
Gstreamer ≫ Gstreamer Version 0.10.11
Gstreamer ≫ Gstreamer Version 0.10.12
Gstreamer ≫ Gstreamer Version 0.10.13
Gstreamer ≫ Gstreamer Version 0.10.14
Gstreamer ≫ Gstreamer Version 0.10.15
Gstreamer ≫ Gstreamer Version 0.10.16
Gstreamer ≫ Gstreamer Version 0.10.17
Gstreamer ≫ Gstreamer Version 0.10.18
Gstreamer ≫ Gstreamer Version 0.10.19
Gstreamer ≫ Gstreamer Version 0.10.20
Gstreamer ≫ Gstreamer Version 0.10.21
Gstreamer ≫ Gstreamer Version 0.10.22
Gstreamer ≫ Gstreamer Version 0.10.23
Gstreamer ≫ Gstreamer Version 0.10.24
Gstreamer ≫ Gstreamer Version 0.10.25
Gstreamer ≫ Gstreamer Version 0.10.26
Gstreamer ≫ Gstreamer Version 0.10.27
Gstreamer ≫ Gstreamer Version 0.10.28
Gstreamer ≫ Gstreamer Version 0.10.29
Gstreamer ≫ Gstreamer Version 0.10.30
Gstreamer ≫ Gstreamer Version 0.10.31
Gstreamer ≫ Gstreamer Version 0.10.32
Gstreamer ≫ Gstreamer Version 0.10.33
Gstreamer ≫ Gstreamer Version 0.10.34
Gstreamer ≫ Gstreamer Version 0.10.35
Gstreamer ≫ Gstreamer Version 0.10.36
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.84% 0.848
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://security.gentoo.org/glsa/201705-10
http://rhn.redhat.com/errata/RHSA-2017-0018.html
http://rhn.redhat.com/errata/RHSA-2016-2974.html
http://www.openwall.com/lists/oss-security/2016/11/18/12
http://www.openwall.com/lists/oss-security/2016/11/18/13
http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html
http://www.securityfocus.com/bid/94427