GStreamer security, bug fix, and enhancement update

clutter-gst2
Clutter is an open source software library for creating fast, visually
rich and animated graphical user interfaces.

Clutter GStreamer enables the use of GStreamer with Clutter.

gnome-video-effects
A collection of GStreamer effects to be used in different GNOME Modules.

gstreamer1
GStreamer is a streaming media framework, based on graphs of filters which
operate on media data. Applications using this library can do anything
from real-time sound processing to playing videos, and just about anything
else media-related. Its plugin-based architecture means that new data
types or processing capabilities can be added simply by installing new
plugins.

gstreamer1-plugins-bad-free
GStreamer is a streaming media framework, based on graphs of elements which
operate on media data.

This package contains plug-ins that aren't tested well enough, or the code
is not of good enough quality.

gstreamer1-plugins-base
GStreamer is a streaming media framework, based on graphs of filters which
operate on media data. Applications using this library can do anything
from real-time sound processing to playing videos, and just about anything
else media-related. Its plugin-based architecture means that new data
types or processing capabilities can be added simply by installing new
plug-ins.

This package contains a set of well-maintained base plug-ins.

gstreamer1-plugins-good
GStreamer is a streaming media framework, based on graphs of filters which
operate on media data. Applications using this library can do anything
from real-time sound processing to playing videos, and just about anything
else media-related. Its plugin-based architecture means that new data
types or processing capabilities can be added simply by installing new
plugins.

GStreamer Good Plugins is a collection of well-supported plugins of
good quality and under the LGPL license.

gstreamer-plugins-bad-free
GStreamer is a streaming media framework, based on graphs of elements which
operate on media data.

This package contains plug-ins that aren't tested
well enough, or the code is not of good enough quality.

gstreamer-plugins-good
GStreamer is a streaming media framework, based on graphs of filters which
operate on media data. Applications using this library can do anything
from real-time sound processing to playing videos, and just about anything
else media-related. Its plugin-based architecture means that new data
types or processing capabilities can be added simply by installing new
plug-ins.

GStreamer Good Plug-ins is a collection of well-supported plug-ins of
good quality and under the LGPL license.

orc
Orc is a library and set of tools for compiling and executing
very simple programs that operate on arrays of data. The "language"
is a generic assembly language that represents many of the features
available in SIMD architectures, including saturated addition and
subtraction, and many arithmetic operations.

CVE-2016-1019
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to
cause a denial of service (application crash) or possibly execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2016.
CVE-2016-9446
The vmnc decoder in the gstreamer does not initialize the render
canvas, which allows remote attackers to obtain sensitive information
as demonstrated by thumbnailing a simple 1 frame vmnc movie that does
not draw to the allocated render canvas.
CVE-2016-9810
The gst_decode_chain_free_internal function in the flxdex decoder in
gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to
cause a denial of service (invalid memory read and crash) via an
invalid file, which triggers an incorrect unref call.
CVE-2016-9811
The windows_icon_typefind function in gst-plugins-base in GStreamer
before 1.10.2, when G_SLICE is set to always-malloc, allows remote
attackers to cause a denial of service (out-of-bounds read) via a
crafted ico file.
CVE-2017-5837
The gst_riff_create_audio_caps function in
gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before
1.10.3 allows remote attackers to cause a denial of service (floating
point exception and crash) via a crafted video file.
CVE-2017-5838
The gst_date_time_new_from_iso8601_string function in
gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers
to cause a denial of service (out-of-bounds heap read) via a malformed
datetime string.
CVE-2017-5839
The gst_riff_create_audio_caps function in
gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before
1.10.3 does not properly limit recursion, which allows remote
attackers to cause a denial of service (stack overflow and crash) via
vectors involving nested WAVEFORMATEX.
CVE-2017-5840
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in
gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to
cause a denial of service (out-of-bounds heap read) via vectors
involving the current stts index.
CVE-2017-5841
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in
gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to
cause a denial of service (out-of-bounds heap read) via vectors
involving ncdt tags.
CVE-2017-5842
The html_context_handle_element function in gst/subparse/samiparse.c
in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers
to cause a denial of service (out-of-bounds write) via a crafted SMI
file, as demonstrated by OneNote_Manager.smi.
CVE-2017-5843
Multiple use-after-free vulnerabilities in the (1)
gst_mini_object_unref, (2) gst_tag_list_unref, and (3)
gst_mxf_demux_update_essence_tracks functions in GStreamer before
1.10.3 allow remote attackers to cause a denial of service (crash) via
vectors involving stream tags, as demonstrated by 02785736.mxf.
CVE-2017-5844
The gst_riff_create_audio_caps function in
gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before
1.10.3 allows remote attackers to cause a denial of service (floating
point exception and crash) via a crafted ASF file.
CVE-2017-5845
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in
gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to
cause a denial of service (invalid memory read and crash) via a ncdt
sub-tag that "goes behind" the surrounding tag.
CVE-2017-5848
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in
gst-plugins-bad in GStreamer allows remote attackers to cause a denial
of service (invalid memory read and crash) via vectors involving PSM
parsing.