GStreamer gst-plugins-bad1 Vulnerability: Denial of Service via NULL Pointer Dereference
Summary
ALPINE-CVE-2016-9813: The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. Affects gst-plugins-bad1 versions < 1.8.3-r0. Fixed in 1.8.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework that enables the handling of audio and video streams. The gst-plugins-bad1 package contains a variety of plugins that are not yet up to par with the quality of the core plugins but are still useful for various multimedia applications. This package is crucial for developers looking to implement advanced multimedia functionalities. However, it has been found to be vulnerable to a denial of service attack due to a flaw in the mpegts parser.
Vulnerability Detail
The vulnerability arises from the _parse_pat function in the mpegts parser of GStreamer versions prior to 1.10.2. This flaw allows remote attackers to craft malicious files that, when processed, can lead to a NULL pointer dereference and crash the application. The potential ramifications include service interruptions and degraded user experience, making it critical for users of the affected package to address this issue promptly.
How To Fix
Minimum fixed version
1.8.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-bad1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or potentially malicious files with the affected version of the gst-plugins-bad1 package until the update is applied.
Conclusion
The vulnerability in the GStreamer gst-plugins-bad1 package poses a significant risk of denial of service due to a NULL pointer dereference. Users are strongly encouraged to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for gst-plugins-bad1 →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Failure to address this vulnerability may lead to service disruptions and crashes, impacting user experience and application reliability.
Yes, avoid processing untrusted files with the affected package until the update is applied.
More information about GStreamer and its plugins can be found on the official GStreamer website and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-bad1.
