CVE-2017-5842: Medium severity Gstreamer Project Gstreamer vulnerability
An out-of-bounds heap read in htmlcontexthandleelement was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777502
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/d894c19
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
Other sources
The htmlcontexthandleelement function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNoteManager.smi.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade
GStreamer gst-plugins-baseto a version that resolves this vulnerability.Fixed in 1.10.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5842?
CVE-2017-5842 has a severity rating that indicates it can lead to denial of service due to an out-of-bounds write.
How do I fix CVE-2017-5842?
To fix CVE-2017-5842, upgrade GStreamer to version 1.10.3 or later.
What versions of GStreamer are affected by CVE-2017-5842?
Versions of GStreamer before 1.10.3, specifically up to 1.10.2, are affected by CVE-2017-5842.
What kind of attack does CVE-2017-5842 enable?
CVE-2017-5842 enables remote attackers to cause a denial of service through crafted SMI files.
In which component of GStreamer does CVE-2017-5842 occur?
CVE-2017-5842 occurs in the html_context_handle_element function within gst/subparse/samiparse.c.