Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.ORACLELINUX_ELSA-2017-2060.NASL
HistorySep 07, 2023 - 12:00 a.m.

Oracle Linux 7 : GStreamer (ELSA-2017-2060)

2023-09-0700:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
6
JSON

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2060 advisory.

  • The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file. (CVE-2016-10198)

  • The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call. (CVE-2016-9810)

  • The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. (CVE-2016-9811)

  • The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags. (CVE-2017-5841)

  • The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi. (CVE-2017-5842)

  • Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.
    (CVE-2017-5843)

  • The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing. (CVE-2017-5848)

  • The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value. (CVE-2016-10199)

  • The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas. (CVE-2016-9446)

  • The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file. (CVE-2017-5837)

  • The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
    (CVE-2017-5838)

  • The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX. (CVE-2017-5839)

  • The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index. (CVE-2017-5840)

  • The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file. (CVE-2017-5844)

  • The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that goes behind the surrounding tag. (CVE-2017-5845)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2017-2060.
##

include('compat.inc');

if (description)
{
  script_id(180851);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/07");

  script_cve_id(
    "CVE-2016-9446",
    "CVE-2016-9810",
    "CVE-2016-9811",
    "CVE-2016-10198",
    "CVE-2016-10199",
    "CVE-2017-5837",
    "CVE-2017-5838",
    "CVE-2017-5839",
    "CVE-2017-5840",
    "CVE-2017-5841",
    "CVE-2017-5842",
    "CVE-2017-5843",
    "CVE-2017-5844",
    "CVE-2017-5845",
    "CVE-2017-5848"
  );

  script_name(english:"Oracle Linux 7 : GStreamer (ELSA-2017-2060)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ELSA-2017-2060 advisory.

  - The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer
    before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a
    crafted audio file. (CVE-2016-10198)

  - The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before
    1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid
    file, which triggers an incorrect unref call. (CVE-2016-9810)

  - The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to
    always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico
    file. (CVE-2016-9811)

  - The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before
    1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors
    involving ncdt tags. (CVE-2017-5841)

  - The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer
    before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI
    file, as demonstrated by OneNote_Manager.smi. (CVE-2017-5842)

  - Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3)
    gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a
    denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.
    (CVE-2017-5843)

  - The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows
    remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM
    parsing. (CVE-2017-5848)

  - The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before
    1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted
    tag value. (CVE-2016-10199)

  - The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to
    obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not
    draw to the allocated render canvas. (CVE-2016-9446)

  - The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer
    before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash)
    via a crafted video file. (CVE-2017-5837)

  - The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows
    remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
    (CVE-2017-5838)

  - The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer
    before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of
    service (stack overflow and crash) via vectors involving nested WAVEFORMATEX. (CVE-2017-5839)

  - The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3
    allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the
    current stts index. (CVE-2017-5840)

  - The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer
    before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash)
    via a crafted ASF file. (CVE-2017-5844)

  - The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before
    1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt
    sub-tag that goes behind the surrounding tag. (CVE-2017-5845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2017-2060.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9446");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/09/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:clutter-gst2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:clutter-gst2-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gnome-video-effects");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer-plugins-bad-free");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer-plugins-bad-free-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer-plugins-bad-free-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer-plugins-good");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer-plugins-good-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-bad-free");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-bad-free-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-bad-free-gtk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-base-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-base-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-base-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:gstreamer1-plugins-good");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:orc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:orc-compiler");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:orc-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:orc-doc");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_release = get_kb_item("Host/RedHat/release");
if (isnull(os_release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var pkgs = [
    {'reference':'gnome-video-effects-0.4.3-1.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-good-devel-docs-0.10.31-13.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-devel-docs-1.10.4-2.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-devel-docs-1.10.4-1.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-doc-0.4.26-1.el7', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-2.0.18-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-devel-2.0.18-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-0.10.23-23.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-devel-0.10.23-23.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-devel-docs-0.10.23-23.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-good-0.10.31-13.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-devel-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-devel-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-gtk-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-1.10.4-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-devel-1.10.4-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-tools-1.10.4-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-good-1.10.4-2.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-0.4.26-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-compiler-0.4.26-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-devel-0.4.26-1.el7', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-2.0.18-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-devel-2.0.18-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-0.10.23-23.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-devel-0.10.23-23.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-good-0.10.31-13.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-devel-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-devel-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-gtk-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-1.10.4-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-devel-1.10.4-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-good-1.10.4-2.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-0.4.26-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-devel-0.4.26-1.el7', 'cpu':'i686', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-2.0.18-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'clutter-gst2-devel-2.0.18-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-0.10.23-23.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-devel-0.10.23-23.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-bad-free-devel-docs-0.10.23-23.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer-plugins-good-0.10.31-13.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-devel-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-devel-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-bad-free-gtk-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-1.10.4-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-devel-1.10.4-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-base-tools-1.10.4-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'gstreamer1-plugins-good-1.10.4-2.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-0.4.26-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-compiler-0.4.26-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'orc-devel-0.4.26-1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (reference && _release) {
    if (exists_check) {
        if (rpm_exists(release:_release, rpm:exists_check) && rpm_check(release:_release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
    } else {
        if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
    }
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'clutter-gst2 / clutter-gst2-devel / gnome-video-effects / etc');
}
VendorProductVersionCPE
oraclelinux7cpe:/o:oracle:linux:7
oraclelinuxclutter-gst2p-cpe:/a:oracle:linux:clutter-gst2
oraclelinuxclutter-gst2-develp-cpe:/a:oracle:linux:clutter-gst2-devel
oraclelinuxgnome-video-effectsp-cpe:/a:oracle:linux:gnome-video-effects
oraclelinuxgstreamer-plugins-bad-freep-cpe:/a:oracle:linux:gstreamer-plugins-bad-free
oraclelinuxgstreamer-plugins-bad-free-develp-cpe:/a:oracle:linux:gstreamer-plugins-bad-free-devel
oraclelinuxgstreamer-plugins-bad-free-devel-docsp-cpe:/a:oracle:linux:gstreamer-plugins-bad-free-devel-docs
oraclelinuxgstreamer-plugins-goodp-cpe:/a:oracle:linux:gstreamer-plugins-good
oraclelinuxgstreamer-plugins-good-devel-docsp-cpe:/a:oracle:linux:gstreamer-plugins-good-devel-docs
oraclelinuxgstreamer1p-cpe:/a:oracle:linux:gstreamer1
Rows per page:
1-10 of 241

References

Related

nessus 50
centos 1
oraclelinux 1
openvas 44
redhat 1
archlinux 3
ubuntu 2
osv 18
mageia 5
debian 10
fedora 19
gentoo 1
rosalinux 1
redhatcve 6
debiancve 9
prion 8
cve 7
ubuntucve 7
alpinelinux 5
veracode 1
nessus
nessus
RHEL 7 : GStreamer (RHSA-2017:2060)
2017-08-03 00:00:00
EulerOS 2.0 SP1 : gstreamer (EulerOS-SA-2017-1205)
2017-09-11 00:00:00
EulerOS 2.0 SP2 : gstreamer (EulerOS-SA-2017-1206)
2017-09-11 00:00:00
centos
centos
clutter, gnome, gstreamer, gstreamer1, orc security update
2017-08-24 01:36:20
oraclelinux
oraclelinux
GStreamer security, bug fix, and enhancement update
2017-08-07 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for gstreamer (EulerOS-SA-2017-1206)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for gstreamer (EulerOS-SA-2017-1205)
2020-01-23 00:00:00
RedHat Update for GStreamer RHSA-2017:2060-01
2017-08-04 00:00:00
redhat
redhat
(RHSA-2017:2060) Moderate: GStreamer security, bug fix, and enhancement update
2017-08-01 05:57:18
archlinux
archlinux
[ASA-201702-3] gst-plugins-good: denial of service
2017-02-03 00:00:00
[ASA-201702-4] gst-plugins-base-libs: multiple issues
2017-02-03 00:00:00
[ASA-201702-5] gst-plugins-bad: multiple issues
2017-02-03 00:00:00
ubuntu
ubuntu
GStreamer Good Plugins vulnerabilities
2017-03-27 00:00:00
GStreamer Base Plugins vulnerabilities
2017-03-27 00:00:00
osv
osv
gst-plugins-good1.0 - security update
2017-03-27 00:00:00
gst-plugins-base1.0 - security update
2017-03-27 00:00:00
gst-plugins-base0.10 - security update
2020-02-28 00:00:00
mageia
mageia
Updated gstreamer0.10-plugins-good and gstreamer1.0-plugins-good packages fix security vulnerabilities
2017-09-21 16:43:32
Updated gstreamer0.10-plugins-base and gstreamer1.0-plugins-base packages fix security vulnerabilities
2017-08-29 23:36:17
Updated gstreamer1.0-plugins-bad packages fix security vulnerability
2018-01-01 18:50:28
debian
debian
[SECURITY] [DSA 3820-1] gst-plugins-good1.0 security update
2017-03-27 20:48:22
[SECURITY] [DSA 3819-1] gst-plugins-base1.0 security update
2017-03-27 20:47:28
[SECURITY] [DLA 2126-1] gst-plugins-base0.10 security update
2020-02-28 22:40:36
fedora
fedora
[SECURITY] Fedora 25 Update: mingw-gstreamer1-plugins-good-1.10.3-1.fc25
2017-02-20 18:54:34
[SECURITY] Fedora 25 Update: mingw-gstreamer1-plugins-base-1.10.3-1.fc25
2017-02-20 18:54:33
[SECURITY] Fedora 35 Update: mingw-gstreamer1-plugins-bad-free-1.19.3-1.fc35
2021-11-26 01:23:02
gentoo
gentoo
GStreamer plug-ins: User-assisted execution of arbitrary code
2017-05-18 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1850
2021-07-02 17:03:31
redhatcve
redhatcve
CVE-2016-9446
2016-11-21 14:17:18
CVE-2016-10199
2019-10-11 10:57:41
CVE-2016-10198
2017-02-06 14:19:50
debiancve
debiancve
CVE-2016-9446
2017-01-23 21:59:00
CVE-2017-5845
2017-02-09 15:59:00
CVE-2016-10199
2017-02-09 15:59:00
prion
prion
Design/Logic Flaw
2017-01-23 21:59:00
Out-of-bounds
2017-02-09 15:59:00
Code injection
2017-02-09 15:59:00
cve
cve
CVE-2016-9446
2017-01-23 21:59:00
CVE-2016-10199
2017-02-09 15:59:00
CVE-2017-5845
2017-02-09 15:59:00
ubuntucve
ubuntucve
CVE-2016-10199
2017-02-09 00:00:00
CVE-2016-9446
2017-01-23 00:00:00
CVE-2017-5845
2017-02-09 00:00:00
alpinelinux
alpinelinux
CVE-2016-10199
2017-02-09 15:59:00
CVE-2017-5845
2017-02-09 15:59:00
CVE-2016-10198
2017-02-09 15:59:00
veracode
veracode
Denial Of Service (DoS)
2018-11-28 04:05:52
JSON
Related for ORACLELINUX_ELSA-2017-2060.NASL
nessus50centos1oraclelinux1openvas44redhat1archlinux3ubuntu2osv18mageia5debian10fedora19gentoo1rosalinux1redhatcve6debiancve9prion8cve7ubuntucve7alpinelinux5veracode1