CVE-2017-5847

The gstasfdemuxprocessextcontentdesc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "last_affected": "8.0"
                },
                {
                    "last_affected": "9.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/gstreamer/gst-plugins-ugly

Affected ranges

Type

GIT

Repo

https://github.com/gstreamer/gst-plugins-ugly

Events

Introduced

Fixed

d21017b52a585f145e8d62781bcc1c5fefc7ee37

Database specific

{
    "source": "REFERENCES"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.1

1.1.2

1.1.3

1.1.4

1.1.90

1.10.0

1.11.0

1.11.1

1.2.0

1.3.1

1.3.2

1.3.3

1.3.90

1.3.91

1.4.0

1.5.1

1.5.2

1.5.90

1.5.91

1.6.0

1.7.1

1.7.2

1.7.90

1.7.91

1.8.0

1.9.1

1.9.2

1.9.90

Other

BEFORE_INDENT

BRANCH-ERROR-ROOT

BRANCH-EVENTS2-ROOT

BRANCH-GSTREAMER-0_8-ROOT

CAPS

CAPS-MERGE-3

CAPS-ROOT

CHANGELOG_START

GIT_CONVERSION

MOVE-TO-FDO

OSLOSUMMIT1-200303051

RELEASE-0_10_0

RELEASE-0_10_1

RELEASE-0_10_10

RELEASE-0_10_11

RELEASE-0_10_2

RELEASE-0_10_3

RELEASE-0_10_4

RELEASE-0_10_5

RELEASE-0_10_6

RELEASE-0_10_7

RELEASE-0_10_8

RELEASE-0_10_9

RELEASE-0_9_1

RELEASE-0_9_3

RELEASE-0_9_4

RELEASE-0_9_5

RELEASE-0_9_6

RELEASE-0_9_7

TYPEFIND-ROOT

start

RELEASE-0.*

RELEASE-0.10.12

RELEASE-0.10.13

RELEASE-0.10.14

RELEASE-0.10.15

RELEASE-0.10.16

RELEASE-0.11.1

RELEASE-0.11.2

RELEASE-0.11.90

RELEASE-0.11.91

RELEASE-0.11.92

RELEASE-0.11.93

RELEASE-0.11.94

RELEASE-0.11.99

Database specific

vanir_signatures

[
    {
        "target": {
            "file": "gst/asfdemux/gstasfdemux.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "279684030150557829107098172575875080776",
                "19223400032722769411560383618065099160",
                "294554796417022036938768244122502567476",
                "264586475648032328220308509779421841923",
                "130953633987926223167011240672415699377",
                "14289265267665371767476224094306881851",
                "340143330638629988969640357432801681471",
                "76767141884024629636231774568565135171"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/gstreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37",
        "signature_version": "v1",
        "id": "CVE-2017-5847-23506d7f",
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "gst_asf_demux_process_ext_content_desc",
            "file": "gst/asfdemux/gstasfdemux.c"
        },
        "digest": {
            "function_hash": "23874994487442955161043057906492805608",
            "length": 4604.0
        },
        "deprecated": false,
        "source": "https://github.com/gstreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37",
        "signature_version": "v1",
        "id": "CVE-2017-5847-8ff06da9",
        "signature_type": "Function"
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5847.json"

vanir_signatures_modified

"2026-05-30T09:15:14Z"

Git / github.com/gstreamer/gstreamer

Affected ranges

Type

GIT

Repo

https://github.com/gstreamer/gstreamer

Events

Introduced

Fixed

c40f6af547f9a3f48501245c5a642bac3b9d8df2

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"
}

Affected versions

gstreamer-vaapi-0.*

gstreamer-vaapi-0.5.10

gstreamer-vaapi-0.6.0

gstreamer-vaapi-0.7.0

gstreamer-vaapi-1.*

gstreamer-vaapi-1.10.0

gstreamer-vaapi-1.11.0

gstreamer-vaapi-1.11.1

gstreamer-vaapi-1.6.0

gstreamer-vaapi-1.7.90

gstreamer-vaapi-1.7.91

gstreamer-vaapi-1.8.0

gstreamer-vaapi-1.9.1

gstreamer-vaapi-1.9.2

gstreamer-vaapi-1.9.90

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5847.json"