CVE-2017-5839: High severity Gstreamer Project Gstreamer vulnerability
An endless recursion leading to a stack overflow in gstriffcreateaudiocaps was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777265
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/ef55c8a
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
Other sources
The gstriffcreateaudiocaps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade
GStreamer gst-plugins-baseto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE assignment
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5839?
CVE-2017-5839 has a severity rating that indicates it can lead to denial of service due to a stack overflow.
How do I fix CVE-2017-5839?
You can fix CVE-2017-5839 by upgrading GStreamer to version 1.10.3 or later.
What does CVE-2017-5839 exploit?
CVE-2017-5839 exploits improper recursion limits in the gst_riff_create_audio_caps function.
Which versions of GStreamer are affected by CVE-2017-5839?
CVE-2017-5839 affects GStreamer versions prior to 1.10.3.
What type of vulnerability is CVE-2017-5839?
CVE-2017-5839 is a denial of service vulnerability caused by a stack overflow.