Gstreamer
CVE-2017-5837
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.
AnalysisAI
A floating-point exception vulnerability exists in the gst_riff_create_audio_caps function within GStreamer's gst-plugins-base library, allowing remote attackers to trigger a denial-of-service condition by crafting malicious video files. GStreamer versions before 1.10.3 are affected. The vulnerability has a moderate CVSS score of 5.5 but an EPSS percentile of 72%, indicating meaningful exploitation probability; a vendor patch is available.
Technical ContextAI
The vulnerability resides in gst-libs/gst/riff/riff-media.c, part of the GStreamer multimedia framework (CPE: cpe:2.3:a:gstreamer:gstreamer). GStreamer is a widely-deployed open-source media pipeline library used across Linux distributions and embedded systems for audio/video processing. The root cause is classified as CWE-369 (Divide By Zero), which occurs when the audio format parsing logic fails to validate numeric parameters before performing division operations. An attacker supplies a crafted RIFF audio header with malformed channel count, sample rate, or block alignment values that cause an unhandled division-by-zero exception during audio capability negotiation, crashing the GStreamer pipeline.
RemediationAI
Upgrade GStreamer and gst-plugins-base to version 1.10.3 or later immediately. Users of Debian should apply security update DSA-3819 (or the Debian LTS update from 2020-02); Red Hat users should apply RHSA-2017:2060; Gentoo users should apply GLSA-201705-10. For applications that cannot be immediately patched, restrict processing of untrusted media files or run GStreamer pipelines in sandboxed/containerized environments with resource limits to minimize crash impact. Validate that media file headers conform to RIFF specifications before passing to GStreamer, though this is not a substitute for patching.
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Same weakness CWE-369 – Divide By Zero
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today