CVE-2017-5846: Medium severity Gstreamer Project Gstreamer vulnerability
The gstasfdemuxprocessextstreamprops function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/gst-plugins-uglyto a version that resolves this vulnerability.Fixed in 1.10.4-r0 - Upgrade
Upgrade
alpine/gst-plugins-ugly1to a version that resolves this vulnerability.Fixed in 1.8.3-r0 - Upgrade
Upgrade
alpine/gst-plugins-ugly1to a version that resolves this vulnerability.Fixed in 1.10.4-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5846?
CVE-2017-5846 has a severity rating classified as high due to its potential to cause denial of service.
How do I fix CVE-2017-5846?
To mitigate CVE-2017-5846, update GStreamer to version 1.10.3 or later.
What causes the vulnerability identified by CVE-2017-5846?
CVE-2017-5846 is caused by an invalid memory read in the gst_asf_demux_process_ext_stream_props function.
Which versions of GStreamer are affected by CVE-2017-5846?
GStreamer versions prior to 1.10.3 are affected by CVE-2017-5846.
Can CVE-2017-5846 be exploited remotely?
Yes, CVE-2017-5846 can be exploited remotely, allowing attackers to crash the application.