Back to Database
Status published
High
CVE-2017-5839
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before...
Vulnerability Description
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-5839
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/96001
- http://www.debian.org/security/2017/dsa-3819
- https://access.redhat.com/errata/RHSA-2017:2060
- http://www.openwall.com/lists/oss-security/2017/02/02/9
- https://bugzilla.gnome.org/show_bug.cgi?id=777265
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.3
- https://security.gentoo.org/glsa/201705-10
- http://www.openwall.com/lists/oss-security/2017/02/01/7
More from gstreamer
View All →CVE-2024-47835
GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser
Medium
6.8
CVE-2024-47834
GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
Medium
5.1
CVE-2024-47778
GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk
Medium
5.1
CVE-2024-47777
GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk
Medium
5.1
CVE-2024-47776
GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk
Medium
5.1
Affected Vendor
gstreamer
View all reports →Affected Software
gstreamer
Vulnerable Versions:
0
Timeline
Official Publish:
February 9th, 2017
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.