CVE-2017-5845
HighSummary
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via invalid memory reads, leading to crashes.
Risk Assessment
Attackers can exploit this vulnerability to remotely trigger application crashes, potentially causing service outages for users.
Recommendation
It is recommended to update GStreamer to version 1.10.3 or later to mitigate this vulnerability.
Other vulnerabilities in GStreamer gst-plugins-good
See all- CVE-2017-5841High
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
- CVE-2016-10199High
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
- CVE-2026-18649High
In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.
Original NVD description (English source)
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.