CVE-2016-9958 - OpenCVE

game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Suse	Linux Enterprise Software Development Kit Linux Enterprise Desktop Suse Linux Enterprise Server Linux Enterprise Workstation Extension Linux Enterprise
Opensuse	Leap Opensuse
Game-music-emu Project	Game-music-emu
Opensuse Project	Leap

Configuration 1 [-]

OR	cpe:2.3:o:opensuse:leap:42.2:::::::*
	cpe:2.3:o:opensuse:opensuse:12.1:::::::*
	cpe:2.3:o:opensuse_project:leap:42.1:::::::*
	cpe:2.3:o:suse:linux_enterprise:12.0:::::::*
	cpe:2.3:o:suse:linux_enterprise_desktop:12:::::::*
	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:::::::*
	cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:::::::*
	cpe:2.3:o:suse:suse_linux_enterprise_server:12:::::::*

Configuration 2 [-]

cpe:2.3:a:game-music-emu_project:game-music-emu:*:*:*:*:*:*:*:*

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html	Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/15/11	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/95305	Third Party Advisory VDB Entry
https://bitbucket.org/mpyne/game-music-emu/wiki/Home	Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/
https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html	Exploit Technical Description Third Party Advisory
https://security.gentoo.org/glsa/201707-02

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: debian

Published: 2017-04-12T20:00:00

Updated: 2017-07-10T09:57:01

Reserved: 2016-12-15T00:00:00

Link: CVE-2016-9958

JSON object: View

NVD Information

Status : Modified

Published: 2017-04-12T20:59:00.370

Modified: 2023-11-07T02:37:40.060

Link: CVE-2016-9958

JSON object: View

Redhat Information

No data.

CWE

CWE-119

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-12-14T00:00:00", "descriptions": [{"lang": "en", "value": "game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T09:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "SUSE-SA:2016:3250", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"name": "FEDORA-2016-fbf9f8b204", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"name": "95305", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95305"}, {"name": "[oss-security] 20161215 Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code execution via malformed SPC music file", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"tags": ["x_refsource_MISC"], "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"name": "GLSA-201707-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201707-02"}, {"name": "FEDORA-2017-5bf9a268df", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"name": "FEDORA-2016-04383482b4", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"name": "FEDORA-2017-3d771a1702", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"name": "openSUSE-SA:2017:0022", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2016-9958", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SA:2016:3250", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"name": "FEDORA-2016-fbf9f8b204", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"name": "95305", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95305"}, {"name": "[oss-security] 20161215 Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code execution via malformed SPC music file", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"name": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html", "refsource": "MISC", "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"name": "GLSA-201707-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201707-02"}, {"name": "FEDORA-2017-5bf9a268df", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"name": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home", "refsource": "CONFIRM", "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"name": "FEDORA-2016-04383482b4", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"name": "FEDORA-2017-3d771a1702", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"name": "openSUSE-SA:2017:0022", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}]}}}}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2016-9958", "datePublished": "2017-04-12T20:00:00", "dateReserved": "2016-12-15T00:00:00", "dateUpdated": "2017-07-10T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*", "matchCriteriaId": "1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*", "matchCriteriaId": "EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse_project:leap:42.1:*:*:*:*:*:*:*", "matchCriteriaId": "CF605E46-ADCE-45B3-BBBA-E593D3CEE2A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*", "matchCriteriaId": "F1EB0F28-F23A-4969-8A3E-66DA2EFA40C3", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*", "matchCriteriaId": "DB2A1559-651C-46B0-B436-8E03DC8A60D2", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*", "matchCriteriaId": "9DFA18B6-2642-470A-A350-68947529EE5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*", "matchCriteriaId": "9C649194-B8C2-49F7-A819-C635EE584ABF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:game-music-emu_project:game-music-emu:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACB689B9-F892-4232-808C-E55B2A678479", "versionEndIncluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations."}, {"lang": "es", "value": "game-music-emu en versiones anteriores a 0.6.1 permite a atacantes remotos escribir en ubicaciones de memoria arbitrarias."}], "id": "CVE-2016-9958", "lastModified": "2023-11-07T02:37:40.060", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-12T20:59:00.370", "references": [{"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"source": "security@debian.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/95305"}, {"source": "security@debian.org", "tags": ["Patch"], "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"source": "security@debian.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"source": "security@debian.org", "url": "https://security.gentoo.org/glsa/201707-02"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}