Denial of Service Vulnerability in GStreamer gst-plugins-bad1 Package
Summary
ALPINE-CVE-2016-9812: The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section. Affects gst-plugins-bad1 versions < 1.8.3-r0. Fixed in 1.8.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GStreamer is a powerful multimedia framework that allows the construction of graphs of media-handling components. The gst-plugins-bad1 package provides a set of plugins that are not up to par with the GStreamer quality standards but are still useful for various media processing tasks. This package is essential for handling various media formats, but it has been found to be vulnerable to a specific issue that can lead to a denial of service.
Vulnerability Detail
The vulnerability arises from the gst_mpegts_section_new function in the mpegts decoder of GStreamer versions prior to 1.10.2. It allows remote attackers to exploit an out-of-bounds read by sending a specially crafted input, which can lead to a denial of service. This vulnerability is critical as it can disrupt the service and affect the availability of applications relying on GStreamer for media processing.
How To Fix
Minimum fixed version
1.8.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-bad1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider restricting access to the application using GStreamer or implementing input validation to mitigate the risk of exploitation until a proper update can be applied.
Conclusion
In summary, the vulnerability in the GStreamer gst-plugins-bad1 package poses a significant risk of denial of service due to an out-of-bounds read. It is crucial to update to the patched version to ensure the security and availability of your applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for gst-plugins-bad1 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The potential consequences include denial of service, which can disrupt the functionality of applications relying on GStreamer for media processing.
Yes, updating to GStreamer version 1.10.2 or later will mitigate this vulnerability.
If immediate updates are not possible, consider implementing input validation and restricting access to the application to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-bad1.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
