CVE-2017-5845

HIGH 7.5CVE-2017-5845 · Published 09/02/2017 · updated 17/06/2026

In short

CVE-2017-5845 is a HIGH (CVSS 7.5) vulnerability affecting gstreamer (gstreamer).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
gstreamer gstreamer	`≤ 1.10.2`	No fix yet

Description

The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.

References

debian.org/security/2017/dsa-3820
openwall.com/lists/oss-security/2017/02/01/7 · Mailing List
openwall.com/lists/oss-security/2017/02/02/9 · Mailing List
securityfocus.com/bid/96001 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:2060
bugzilla.gnome.org/show_bug.cgi · Issue Tracking
gstreamer.freedesktop.org/releases/1.10 · Release Notes
security.gentoo.org/glsa/201705-10

More vulnerabilities in gstreamer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gstreamer

≤ 1.10.2

No fix yet

More vulnerabilities in gstreamer

See all →