Mageia alert MGASA-2017-0320 (gstreamer0.10-plugins-base, gstreamer1.0-plugins-base)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0320: Updated gstreamer0.10-plugins-base and gstreamer1.0-plugins-base packages fix security vulnerabilities 
Date:
    	     
 
Tue, 29 Aug 2017 22:36:53 +0200
Message-ID:
    	     
 
<20170829203653.412B99F875@duvel.mageia.org>
MGASA-2017-0320 - Updated gstreamer0.10-plugins-base and gstreamer1.0-plugins-base packages fix
security vulnerabilities

Publication date: 29 Aug 2017
URL: http://advisories.mageia.org/MGASA-2017-0320.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2017-5837,
     CVE-2017-5839,
     CVE-2017-5842,
     CVE-2017-5844

Description:
Denial of service in GStreamer base plugins can be caused by floating
point exceptions (CVE-2017-5837, CVE-2017-5844), stack overflow
(CVE-2017-5839), or out-of-bounds heap read (CVE-2017-5842).

Note that GStreamer 0.10 was only affected by the floating point
exceptions.

References:
- https://bugs.mageia.org/show_bug.cgi?id=20236
- http://openwall.com/lists/oss-security/2017/02/02/9
- https://lwn.net/Alerts/714996/
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5837
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5839
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5842
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5844

SRPMS:
- 5/core/gstreamer0.10-plugins-base-0.10.36-9.2.mga5
- 5/core/gstreamer1.0-plugins-base-1.4.3-2.2.mga5