—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– ————————————————————————-
Debian Security Advisory DSA-3723-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 24, 2016 https://www.debian.org/security/faq
– ————————————————————————-

Package : gst-plugins-good1.0
CVE ID : CVE-2016-9634 CVE-2016-9635 CVE-2016-9636
Debian Bug : 845375

Chris Evans discovered that the GStreamer 1.0 plugin used to decode
files in the FLIC format allowed execution of arbitrary code. Further
details can be found in his advisory at
https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html

For the stable distribution (jessie), these problems have been fixed in
version 1.4.4-2+deb8u2.

For the unstable distribution (sid), these problems have been fixed in
version 1.10.1-2.

We recommend that you upgrade your gst-plugins-good1.0 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
—–BEGIN PGP SIGNATURE—–

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlg3Tq5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QYWw/+NwWqq40l6EDunwTnyjTek4DSkya7e07RQnLnu/mfkRz4HpNy5fe1DmOQ
IsNqmx0VUVNWIV0YHHKmB3j7eTAJrESMECyrYM7MlMm5q/ZOn/ofY7cFWkg026nF
zCmXp18iHSdQOdUQ3FikCE6kUq6eunLJXbn2y2FvEDabFMMjZ7cco2NMGlLB5a7r
a3GiA8dQflUQrVxjs9eOKR/wLuA4Bj/6ZdLIqYilcLKvf5DhGgbJrO55JmL4rIvn
68uflKPzJUClPQY/c1JW3CaYnJtzpp3ILsGQM20JJHPry+dqXqDr3JxKmAiEQ9Wn
eB1LcNMDP8Hw2vgZYjO3HcgK/liqmM+brQuRBN1Cefqj5X+HXm09ZmMPv3rbov8V
P5FpO6cEkG7BG3vQrbMZ25dvf6r0YVFyInf+RhZB/xWImULBH8n6z5qB0wE8eqpF
Ac9ZvVLgabQi3RQKQaTO5UM0X85o7BQz4yKvKZfjmbHaAkCHyIaVqzn9PQpF4yfJ
ATTW8MPQMfMcX4gGrMf6oZ4clQQDD73T9ly8QKWh41iPTGk6PB22jyKuzprnMtZ6
Cno4qbUCGbpRC3s/NyUhhf8mK1/xLUJSQ4djH2Mvl8ptdXRySFDqaocg3lMrSO7h
it1tivX6fu54Js4MDPdtlnzKusr84siiYfO1ivc6T/8m/VjBTLE=
=Sds7
—–END PGP SIGNATURE—–

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– ————————————————————————-
Debian Security Advisory DSA-3724-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 24, 2016 https://www.debian.org/security/faq
– ————————————————————————-

Package : gst-plugins-good0.10
CVE ID : CVE-2016-9634 CVE-2016-9635 CVE-2016-9636

Chris Evans discovered that the GStreamer 0.10 plugin used to decode
files in the FLIC format allowed execution of arbitrary code. Further
details can be found in his advisory at
https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html

This update removes the insecure FLIC file format plugin.

For the stable distribution (jessie), these problems have been fixed in
version 0.10.31-3+nmu4+deb8u2.

We recommend that you upgrade your gst-plugins-good0.10 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
—–BEGIN PGP SIGNATURE—–

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlg3TrlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qb6g//fHx99MaMNoN8tfgNT82r3HnM2laUnQotz/vZTtULfjSSVlN8GtyOMf3B
/LpY+y990RGL1hJER059CC8vYCYCAk+u3YGW9TeI2WVopziz7YFLlXoToVQFqnBG
caADdzZeme6XEzyOYYCuKEPElzmMeghVDZOOFHT/OGNQsdf47fpSO0nOmvn0LbP9
poclY/0IJHv4JfZ/HD46e/VWV1BGMMJKlgL2d3Ll3+sz2i508VK0fJHYPVWMO8Ln
n4xlde8qTUmytHmW9TIpcKjq2zDcHkJBf6575Z5JZ4OWu9yauV5MsSohU2GqBZzW
5vRWEH60lzBEjlVCdadrsei+56ke0rWRr+ZJE9UPnwdyTZO9nQpcu6Nbu+RsSvg5
rvba8efJWhIUWTpmzbHxWAcaeHytvS5QZIlFlt4G/ujYpaOQ0QIgpuiw/OY1SN5R
visCnIuEG52jzmLYM1a1YC+GGElYCcwq4Uv1v9ZDDaHcOYi+uHxFDm+Yji6Jkd3M
NCrx/GcXB6WatuCd3JduJUenkAHMfKcasJ1O/k9YXFodcBKuHvnYO+q+bE3OKL76
jZyPSz49k5suPyD+NC4YKYQaI90jl+baK8P9yaXrWTXLip9SX04U9D5J3M616tkh
3ud0W9jZ/OHUufnkr1g5PTkEbNsDItq3tPbni46AAxGyT+y8vXg=
=RpfC
—–END PGP SIGNATURE—–