CVE-2017-5841
HighSummary
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
Risk Assessment
An attacker can exploit this vulnerability to crash the application, potentially leading to service unavailability for users.
Recommendation
It is recommended to update GStreamer to version 1.10.3 or later to mitigate this vulnerability.
Other vulnerabilities in GStreamer, gst-plugins-good
See all- CVE-2017-5845High
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via invalid memory reads, leading to crashes.
- CVE-2016-10199High
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
- CVE-2026-18649High
In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.
Original NVD description (English source)
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.