CVE-2017-5845: High severity Gstreamer Project Gstreamer vulnerability
An invalid memory read was found in gstavidemuxparsencdt.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777532
Upstream patch:
https://github.com/GStreamer/gst-plugins-good/commit/4f47835
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
Other sources
The gstavidemuxparsencdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gstreamer1-plugins-goodto a version that resolves this vulnerability.Fixed in 1.10.3 - Upgrade
Upgrade
GStreamer gst-plugins-good (gst_avi_demux_parse_ncdt / gst/avi/gstavidemux.c)to a version that resolves this vulnerability.Fixed in 1.10.3 - Compensating control
Until updated, limit exposure of systems running gst-plugins-good by preventing remote attackers from reaching GStreamer/A/V processing endpoints (e.g., restrict inbound access to only trusted networks).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5845?
CVE-2017-5845 has a moderate severity level due to the potential for an invalid memory read.
How do I fix CVE-2017-5845?
To fix CVE-2017-5845, upgrade the gstreamer1-plugins-good package to version 1.10.3 or later.
What software is affected by CVE-2017-5845?
CVE-2017-5845 affects gstreamer1-plugins-good versions up to 1.10.2.
Is there a known exploit for CVE-2017-5845?
As of now, there are no known exploits publicly available for CVE-2017-5845.
What does CVE-2017-5845 mean for users of GStreamer?
Users of GStreamer should upgrade to the patched version to prevent potential memory-related vulnerabilities.