CVE-2017-5847

The gstasfdemuxprocessextcontentdesc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.

References

Affected packages

Git

github.com/gstreamer/gst-plugins-ugly

Affected ranges

Type: GIT
Repo: https://github.com/gstreamer/gst-plugins-ugly
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d21017b52a585f145e8d62781bcc1c5fefc7ee37

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.1

1.1.2

1.1.3

1.1.4

1.1.90

1.10.0

1.11.0

1.11.1

1.2.0

1.3.1

1.3.2

1.3.3

1.3.90

1.3.91

1.4.0

1.5.1

1.5.2

1.5.90

1.5.91

1.6.0

1.7.1

1.7.2

1.7.90

1.7.91

1.8.0

1.9.1

1.9.2

1.9.90

Other

BEFORE_INDENT

BRANCH-ERROR-ROOT

BRANCH-EVENTS2-ROOT

BRANCH-GSTREAMER-0_8-ROOT

CAPS

CAPS-MERGE-3

CAPS-ROOT

CHANGELOG_START

GIT_CONVERSION

MOVE-TO-FDO

OSLOSUMMIT1-200303051

RELEASE-0_10_0

RELEASE-0_10_1

RELEASE-0_10_10

RELEASE-0_10_11

RELEASE-0_10_2

RELEASE-0_10_3

RELEASE-0_10_4

RELEASE-0_10_5

RELEASE-0_10_6

RELEASE-0_10_7

RELEASE-0_10_8

RELEASE-0_10_9

RELEASE-0_9_1

RELEASE-0_9_3

RELEASE-0_9_4

RELEASE-0_9_5

RELEASE-0_9_6

RELEASE-0_9_7

TYPEFIND-ROOT

start

RELEASE-0.*

RELEASE-0.10.12

RELEASE-0.10.13

RELEASE-0.10.14

RELEASE-0.10.15

RELEASE-0.10.16

RELEASE-0.10.17

RELEASE-0.10.18

RELEASE-0.11.1

RELEASE-0.11.2

RELEASE-0.11.90

RELEASE-0.11.91

RELEASE-0.11.92

RELEASE-0.11.93

RELEASE-0.11.94

RELEASE-0.11.99

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "source": "https://github.com/gstreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37",
        "id": "CVE-2017-5847-23506d7f",
        "target": {
            "file": "gst/asfdemux/gstasfdemux.c"
        },
        "digest": {
            "line_hashes": [
                "279684030150557829107098172575875080776",
                "19223400032722769411560383618065099160",
                "294554796417022036938768244122502567476",
                "264586475648032328220308509779421841923",
                "130953633987926223167011240672415699377",
                "14289265267665371767476224094306881851",
                "340143330638629988969640357432801681471",
                "76767141884024629636231774568565135171"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://github.com/gstreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37",
        "id": "CVE-2017-5847-8ff06da9",
        "target": {
            "file": "gst/asfdemux/gstasfdemux.c",
            "function": "gst_asf_demux_process_ext_content_desc"
        },
        "digest": {
            "function_hash": "23874994487442955161043057906492805608",
            "length": 4604.0
        },
        "signature_type": "Function",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5847.json"

github.com/gstreamer/gstreamer

Affected ranges

Type: GIT
Repo: https://github.com/gstreamer/gstreamer
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

6bc2f3844d91e92d11f8d0219f586801f1449fc1

Affected versions

gst-python-0.*

gst-python-0.1.0

gst-python-0.10.0

gst-python-0.10.1

gst-python-0.10.10

gst-python-0.10.11

gst-python-0.10.12

gst-python-0.10.13

gst-python-0.10.14

gst-python-0.10.15

gst-python-0.10.16

gst-python-0.10.17

gst-python-0.10.18

gst-python-0.10.19

gst-python-0.10.2

gst-python-0.10.20

gst-python-0.10.21

gst-python-0.10.22

gst-python-0.10.3

gst-python-0.10.4

gst-python-0.10.5

gst-python-0.10.6

gst-python-0.10.7

gst-python-0.10.8

gst-python-0.10.9

gst-python-0.7.90

gst-python-0.7.91

gst-python-0.7.92

gst-python-0.7.93

gst-python-0.7.94

gst-python-0.8.0

gst-python-0.8.1

gst-python-0.9.3

gst-python-0.9.4

gst-python-0.9.5

gst-python-0.9.6

gst-python-0.9.7

gst-python-1.*

gst-python-1.1.90

gst-python-1.10.0

gst-python-1.11.0

gst-python-1.11.1

gst-python-1.2.0

gst-python-1.3.90

gst-python-1.4.0

gst-python-1.5.2

gst-python-1.6.0

gst-python-1.7.1

gst-python-1.7.2

gst-python-1.7.90

gst-python-1.7.91

gst-python-1.8.0

gst-python-1.9.1

gst-python-1.9.2

gst-python-1.9.90

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5847.json"

gitlab.freedesktop.org/gstreamer/gstreamer

Affected ranges

Type: GIT
Repo: https://gitlab.freedesktop.org/gstreamer/gstreamer
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c40f6af547f9a3f48501245c5a642bac3b9d8df2

Affected versions

gstreamer-vaapi-0.*

gstreamer-vaapi-0.5.10

gstreamer-vaapi-0.6.0

gstreamer-vaapi-0.7.0

gstreamer-vaapi-1.*

gstreamer-vaapi-1.10.0

gstreamer-vaapi-1.11.0

gstreamer-vaapi-1.11.1

gstreamer-vaapi-1.6.0

gstreamer-vaapi-1.7.90

gstreamer-vaapi-1.7.91

gstreamer-vaapi-1.8.0

gstreamer-vaapi-1.9.1

gstreamer-vaapi-1.9.2

gstreamer-vaapi-1.9.90

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5847.json"