Stack Overflow Vulnerability in gst-plugins-base1
Summary
CVE-2017-5839: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stac... Affects gst-plugins-base1 across 2 version ranges.
< 1.8.3-r0
< d16edfdc698310fe25079136140d347f6d4b3835
Fixed in 1.8.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gst-plugins-base1 is an open-source multimedia framework that provides a set of plugins for GStreamer, a popular multimedia framework used in various applications. These plugins enable the handling of different media formats and provide essential functionalities for audio and video processing. However, a vulnerability has been identified in gst-plugins-base1 that can lead to a stack overflow and subsequent crash when processing nested WAVEFORMATEX data.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5839, originates from the gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c. This function does not properly limit recursion, allowing remote attackers to exploit the vulnerability. By providing specially crafted nested WAVEFORMATEX data, an attacker can trigger a stack overflow, leading to a denial of service condition and potentially crashing the affected application. The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.8.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-base1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended fix by updating the gst-plugins-base1 package to the latest version.
Conclusion
In conclusion, the gst-plugins-base1 package is vulnerable to a stack overflow issue that can be triggered by processing nested WAVEFORMATEX data. To mitigate this vulnerability, users should update their installations to the latest version of gst-plugins-base1. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gst-plugins-base1 →
FAQ
gst-plugins-base1 is an open-source multimedia framework that provides a set of plugins for GStreamer, enabling audio and video processing in various applications.
The vulnerability allows remote attackers to cause a denial of service by triggering a stack overflow and crashing the affected application.
To fix this vulnerability, update the gst-plugins-base1 package to version 1.8.3-r0 or later.
No workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by updating the gst-plugins-base1 package.
The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base1.
