CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins...
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
CVE-2017-5847- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
CVE-2017-5847- Updated
- 2026-11-02
EUVDEUVD-2017-14924 No score
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
EUVD-2017-14924- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5pg-9rvj-55gp
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins...
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
GHSA-j5pg-9rvj-55gp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
ALPINE-CVE-2017-5847- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
CVE-2017-5847- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
DEBIAN-CVE-2017-5847- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- Record
UBUNTU-CVE-2017-5847- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0014 No score
Updated gstreamer0.10-plugins-ugly/gstreamer1.0-plugins-ugly packages fix security vulnerability
Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened (CVE-2017-5846, CVE-2017-5847).
- Record
MGASA-2018-0014- Updated
- 2026-11-02
OSVMGASA-2018-0015 No score
Updated gstreamer0.10-plugins-ugly packages fix security vulnerability
Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened (CVE-2017-5846, CVE-2017-5847).
- Record
MGASA-2018-0015- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10826-1 No score
gstreamer-1.18.5-2.1 on GA media
These are all security issues fixed in the gstreamer-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10826-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10827-1 No score
gstreamer-plugins-bad-1.18.5-2.1 on GA media
These are all security issues fixed in the gstreamer-plugins-bad-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10827-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10830-1 No score
gstreamer-plugins-ugly-1.18.5-2.1 on GA media
These are all security issues fixed in the gstreamer-plugins-ugly-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10830-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-uglyAlpine:v3.7 |
before 1.10.4-r0 | 1.10.4-r0 |
gst-plugins-ugly1Alpine:v3.4 |
before 1.8.3-r0 | 1.8.3-r0 |
gst-plugins-ugly1Alpine:v3.5 |
before 1.8.3-r0 | 1.8.3-r0 |
gst-plugins-ugly1Alpine:v3.6 |
before 1.10.4-r0 | 1.10.4-r0 |
gst-plugins-ugly1.0Debian:12 |
before 1.10.4-1 | 1.10.4-1 |
gst-plugins-ugly1.0Debian:13 |
before 1.10.4-1 | 1.10.4-1 |
gst-plugins-ugly1.0Debian:14 |
before 1.10.4-1 | 1.10.4-1 |
gst-plugins-ugly0.10Debian:8 From an advisory covering 2 CVEs |
before 0.10.19-2.1+deb8u1, plus listed versions 0.10.19-2.1 |
0.10.19-2.1+deb8u1 |
gst-plugins-ugly0.10Debian:7 From an advisory covering 2 CVEs |
before 0.10.19-2+deb7u1, plus listed versions 0.10.19-2 |
0.10.19-2+deb7u1 |
gst-plugins-ugly1.0Debian:8 From an advisory covering 2 CVEs |
before 1.4.4-2+deb8u1, plus listed versions 1.4.4-2 |
1.4.4-2+deb8u1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gstreamer0.10-plugins-uglyMageia:5 From an advisory covering 2 CVEs |
before 0.10.19-14.2.mga5 | 0.10.19-14.2.mga5 |
gstreamer1.0-plugins-uglyMageia:5 From an advisory covering 2 CVEs |
before 1.4.3-2.1.mga5 | 1.4.3-2.1.mga5 |
gstreamer0.10-plugins-uglyMageia:5 From an advisory covering 2 CVEs |
before 0.10.19-14.2.mga5.tainted | 0.10.19-14.2.mga5.tainted |
gstreamer1.0-plugins-uglyMageia:5 From an advisory covering 2 CVEs |
before 1.4.3-2.1.mga5.tainted | 1.4.3-2.1.mga5.tainted |
gstreamer0.10-plugins-uglyMageia:6 From an advisory covering 2 CVEs |
before 0.10.19-18.1.mga6 | 0.10.19-18.1.mga6 |
gstreamer0.10-plugins-uglyMageia:6 From an advisory covering 2 CVEs |
before 0.10.19-18.1.mga6.tainted | 0.10.19-18.1.mga6.tainted |
gst-plugins-ugly0.10Ubuntu:14.04:LTS |
before 0.10.19-2+deb7u1ubuntu0.1, plus listed versions 0.10.19-20.10.19-2ubuntu10.10.19-2ubuntu20.10.19-2ubuntu30.10.19-2ubuntu5 |
0.10.19-2+deb7u1ubuntu0.1 |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 8 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm11.8.3-1ubuntu0.1+esm2 |
None known |
gstreameropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.18.5-2.1 | 1.18.5-2.1 |
gstreamer-plugins-badopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.18.5-2.1 | 1.18.5-2.1 |
gstreamer-plugins-uglyopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.18.5-2.1 | 1.18.5-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5847 is a high vulnerability (CVSS 7.5) in Gstreamer, published February 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.63%, the 89th percentile. Fixed in gst-plugins-ugly 1.10.4-r0.
References
github.com/GStreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37
bugzilla.gnome.org/show_bug.cgi?id=777955
securityfocus.com/bid/96001
debian.org/security/2017/dsa-3821
openwall.com/lists/oss-security/2017/02/02/9
security.gentoo.org/glsa/201705-10
Show 18 moreShow less
lists.debian.org/debian-lts-announce/2020/05/msg00030.html
nvd.nist.gov/vuln/detail/CVE-2017-5847
security.alpinelinux.org/vuln/CVE-2017-5847
security-tracker.debian.org/tracker/CVE-2017-5847
advisories.mageia.org/MGASA-2018-0014.html
bugs.mageia.org/show_bug.cgi?id=20239
lwn.net/Alerts/714998
ubuntu.com/security/CVE-2017-5847
cve.org/CVERecord?id=CVE-2017-5847
suse.com/security/cve/CVE-2016-10198