7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.033 Low
EPSS
Percentile
91.2%
Severity: Critical
Date : 2017-02-03
CVE-ID : CVE-2017-5837 CVE-2017-5839 CVE-2017-5842 CVE-2017-5844
Package : gst-plugins-base-libs
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-164
The package gst-plugins-base-libs before version 1.10.3-1 is vulnerable
to multiple issues including arbitrary code execution and denial of
service.
Upgrade to 1.10.3-1.
The problems have been fixed upstream in version 1.10.3.
None.
A floating point exception issue has been found in gstreamer before
1.10.3, in gst_riff_create_audio_caps.
An endless recursion issue leading to stack overflow has been found in
gstreamer before 1.10.3, in gst_riff_create_audio_caps.
An off-by-one write has been found in gstreamer before 1.10.3, in
html_context_handle_element.
A floating point exception issue has been found in gstreamer before
1.10.3, in gst_riff_create_audio_caps.
A remote attacker can crash gstreamer or execute arbitrary code on the
affected host via a crafted file.
http://seclists.org/oss-sec/2017/q1/284
https://bugzilla.gnome.org/show_bug.cgi?id=777262
https://bugzilla.gnome.org/show_bug.cgi?id=777265
https://bugzilla.gnome.org/show_bug.cgi?id=777502
https://bugzilla.gnome.org/show_bug.cgi?id=777525
https://security.archlinux.org/CVE-2017-5837
https://security.archlinux.org/CVE-2017-5839
https://security.archlinux.org/CVE-2017-5842
https://security.archlinux.org/CVE-2017-5844
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | gst-plugins-base-libs | < 1.10.3-1 | UNKNOWN |
seclists.org/oss-sec/2017/q1/284
bugzilla.gnome.org/show_bug.cgi?id=777262
bugzilla.gnome.org/show_bug.cgi?id=777265
bugzilla.gnome.org/show_bug.cgi?id=777502
bugzilla.gnome.org/show_bug.cgi?id=777525
security.archlinux.org/AVG-164
security.archlinux.org/CVE-2017-5837
security.archlinux.org/CVE-2017-5839
security.archlinux.org/CVE-2017-5842
security.archlinux.org/CVE-2017-5844
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.033 Low
EPSS
Percentile
91.2%