What’s Vulnerable › Vulnerabilities
CVE-2016-9446
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-01-23 · updated 2026-06-17
- Weakness: CWE-665
Description
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
Affected products
- Fedoraproject Fedora: 35
- GStreamer: before 1.11.1 — fixed in 1.11.1
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
- RedHat Enterprise Linux Server Tus: 7.6, 7.7
- RedHat Enterprise Linux Workstation: 7.0
How to fix
Upgrade to a fixed version: GStreamer 1.11.1. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2016/11/18/12
- http://www.openwall.com/lists/oss-security/2016/11/18/13
- http://www.securityfocus.com/bid/94423
- https://access.redhat.com/errata/RHSA-2017:2060
- https://bugzilla.gnome.org/show_bug.cgi?id=774533
- https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM7IXFGHV66KNWGWG6ZBDNKXD2UJL2VQ/
- https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
- https://security.gentoo.org/glsa/201705-10
- http://www.openwall.com/lists/oss-security/2016/11/18/12
- http://www.openwall.com/lists/oss-security/2016/11/18/13
- http://www.securityfocus.com/bid/94423
Get alerted when CVE-2016-9446 or the next vulnerability affects your stack