ALPINE-CVE-2016-10199

The qtdemuxtagaddstrfull function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted tag value...

Code injection

The gstaacparsesinksetcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted audio file...

DEBIAN-CVE-2016-10199

The qtdemuxtagaddstrfull function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted tag value...

ALPINE-CVE-2016-10198

The gstaacparsesinksetcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted audio file...

CVE-2016-10199

The qtdemuxtagaddstrfull function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted tag value...

DEBIAN-CVE-2016-10198

The gstaacparsesinksetcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted audio file...

UBUNTU-CVE-2017-5848

The gstpsdemuxparsepsm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service invalid memory read and crash via vectors involving PSM parsing...

UBUNTU-CVE-2017-5838

The gstdatetimenewfromiso8601string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds heap read via a malformed datetime string...

CVE-2017-5841

The CVE-2017-5841 entry affects the GStreamer project, specifically the gst-plugins-good component. It concerns the gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c and is exploitable via crafted audiovisual files to trigger an out-of-bounds heap read, causing a denial of service. Publi...

CVE-2017-5842

The htmlcontexthandleelement function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds write via a crafted SMI file, as demonstrated by OneNoteManager.smi...

CVE-2016-10199

The CVE-2016-10199 issue affects GStreamer’s gst-plugins-good before version 1.10.3, where the qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c can trigger an out-of-bounds read leading to a crash (denial of service). Public sources in connected documents confirm upstream fixes; remediat...

CVE-2017-5838

CVE-2017-5838 affects the GStreamer 1.x framework (before 1.10.3). The vulnerability is in gst_date_time_new_from_iso8601_string (gst/gstdatetime.c) and allows a remote attacker to cause a denial of service via an out-of-bounds heap read when processing a malformed datetime string. Affected produ...

CVE-2017-5844

The CVE-2017-5844 issue affects GStreamer’s gst-plugins-base (gst_riff_create_audio_caps in riff-media.c). A crafted ASF file can trigger a floating point exception, causing a denial of service (crash). Affected version: gst-plugins-base before 1.10.3. Mitigation: upgrade to 1.10.3 or newer (as r...

CVE-2017-5840

CVE-2017-5840 affects the GStreamer project, specifically the gst-plugins-good package. The vulnerability is in the qtdemux_parse_samples function (gst/isomp4/qtdemux.c) and can be triggered to cause an out-of-bounds heap read, leading to denial of service. The issue is exploitable via crafted me...

CVE-2017-5842

CVE-2017-5842 affects GStreamer’s gst-plugins-base (base components) prior to version 1.10.3. The flaw is in html_context_handle_element (gst/subparse/samiparse.c), described as an off-by-one write in a crafted SMI file, which could allow remote attackers to trigger a denial of service. Some sour...

CVE-2017-5846

The gstasfdemuxprocessextstreamprops function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service invalid memory read and crash via vectors related to the number of languages in a video file...

CVE-2017-5841

The gstavidemuxparsencdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service out-of-bounds heap read via vectors involving ncdt tags...

CVE-2017-5847

The gstasfdemuxprocessextcontentdesc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service out-of-bounds heap read via vectors involving extended content descriptors...

CVE-2017-5839

CVE-2017-5839 affects the GStreamer gst-plugins-base before 1.10.3. The function gst_riff_create_audio_caps does not properly limit recursion, enabling remote attackers to cause a denial of service via vectors involving nested WAVEFORMATEX, resulting in a stack overflow/crash. Affected versions: ...

CVE-2017-5847

CVE-2017-5847 affects the GStreamer gst-plugins-ugly package, specifically the asfdemux element (gst_asf_demux_process_ext_content_desc in gst/asfdemux/gstasfdemux.c). The vulnerability allows a remote attacker to trigger a denial of service via an out-of-bounds heap read when processing extended...