Denial of Service Vulnerability in GStreamer gst-plugins-base1 Package
Summary
ALPINE-CVE-2017-5837: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a cra... Affects gst-plugins-base1 versions < 1.8.3-r0. Fixed in 1.8.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework that enables the handling of audio and video streams. The gst-plugins-base1 package is a collection of essential plugins for GStreamer, providing functionalities such as audio and video encoding, decoding, and processing. This package is widely used in various applications for media playback and streaming. However, it has been identified to have a vulnerability that can lead to a denial of service under certain conditions.
Vulnerability Detail
The vulnerability lies in the gst_riff_create_audio_caps function located in the riff-media.c file of the gst-plugins-base package. This issue allows remote attackers to exploit crafted video files, leading to a floating point exception and subsequent crash of the application. The vulnerability is present in GStreamer versions prior to 1.10.3, making it critical for applications relying on this package to handle media files safely.
How To Fix
Minimum fixed version
1.8.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-base1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating the package is not immediately feasible, consider implementing input validation to filter out potentially malicious video files before processing them. This can help mitigate the risk of triggering the vulnerability.
Conclusion
The identified vulnerability in the GStreamer gst-plugins-base1 package poses a risk of denial of service through crafted video files. It is crucial for users to update to the patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for gst-plugins-base1 →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The primary impact is a denial of service, which can cause applications to crash when processing malicious video files, leading to disruption in service.
Implementing strict input validation and updating to the patched version of the package are effective ways to prevent exploitation.
Versions of gst-plugins-base1 prior to 1.10.3 are affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base1.
