The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gst-plugins-base1 | Sep 20, 2017 | Feb 9, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 9, 2017 |
| Centos_linux | — | Upgrade gstreamer1-plugins-bad-free-develUpgrade gstreamer1-plugins-base-develUpgrade gstreamer1-plugins-base-toolsUpgrade clutter-gst2-debuginfoUpgrade gstreamer1-plugins-base-devel-docsUpgrade gstreamer1Upgrade gstreamer1-plugins-bad-freeUpgrade gstreamer-plugins-bad-free-devel-docsUpgrade gstreamer1-plugins-good-debuginfoUpgrade orc-debuginfoUpgrade gstreamer1-plugins-base-debuginfoUpgrade gstreamer-plugins-good-debuginfoUpgrade orc-docUpgrade gstreamer1-plugins-bad-free-debuginfoUpgrade orcUpgrade orc-develUpgrade gstreamer1-devel-docsUpgrade gstreamer-plugins-bad-free-debuginfoUpgrade clutter-gst2-develUpgrade gstreamer-plugins-good-devel-docsUpgrade gstreamer1-develUpgrade gstreamer1-plugins-bad-free-gtkUpgrade orc-compilerUpgrade gstreamer-plugins-bad-freeUpgrade gnome-video-effectsUpgrade gstreamer-plugins-bad-free-develUpgrade gstreamer1-plugins-goodUpgrade gstreamer-plugins-goodUpgrade gstreamer1-plugins-baseUpgrade gstreamer1-debuginfoUpgrade clutter-gst2 | Aug 28, 2019 | Feb 9, 2017 |
| Debian | — | Upgrade gst-plugins-base1.0 | Mar 28, 2017 | Feb 9, 2017 |
| Gentoo Linux | — | Upgrade media-libs/gst-plugins-ugly.Upgrade media-libs/gst-plugins-base.Upgrade media-libs/gst-plugins-bad.Upgrade media-libs/gst-plugins-good. | Oct 30, 2017 | Feb 9, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gstreamer-plugins-bad-free-develUpgrade gstreamer1-plugins-base-toolsUpgrade gstreamer1-plugins-base-develUpgrade gstreamer-plugins-goodUpgrade gstreamer-plugins-bad-freeUpgrade gstreamer1-plugins-baseUpgrade gstreamer1-develUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer-plugins-bad-free-devel-docsUpgrade gstreamer1-plugins-goodUpgrade gstreamer1 | Nov 30, 2017 | Feb 9, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gstreamer1Upgrade gstreamer1-plugins-base-develUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-develUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer1-plugins-base | Nov 30, 2017 | Feb 9, 2017 |
| Oracle Solaris | — | Upgrade library/audio/gstreamer to version 0.10.32-0.175.3.0.0.26.0 on Solaris 11.3Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 9, 2017 |
| Oracle_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-bad-free-gtkUpgrade gstreamer1-plugins-base-develUpgrade gstreamer1-plugins-bad-free-develUpgrade clutter-gst2Upgrade clutter-gst2-develUpgrade gstreamer1-devel-docsUpgrade gstreamer-plugins-good-devel-docsUpgrade gstreamer-plugins-bad-freeUpgrade gstreamer-plugins-bad-free-develUpgrade gstreamer1-develUpgrade orc-docUpgrade gstreamer-plugins-goodUpgrade gstreamer1Upgrade gnome-video-effectsUpgrade orc-compilerUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer-plugins-bad-free-devel-docs | Aug 8, 2017 | Jan 15, 2016 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-bad-free-develUpgrade gstreamer1-plugins-base-toolsUpgrade gstreamer1-develUpgrade gstreamer1-plugins-base-develUpgrade gstreamer1-plugins-bad-free-debuginfoUpgrade clutter-gst2-develUpgrade gstreamer1-plugins-bad-free-gtkUpgrade orcUpgrade gstreamer-plugins-good-debuginfoUpgrade gstreamer-plugins-good-devel-docsUpgrade orc-docUpgrade orc-develUpgrade gstreamer-plugins-bad-free-debuginfoUpgrade gstreamer1-plugins-base-debuginfoUpgrade gstreamer1-devel-docsUpgrade clutter-gst2-debuginfoUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer1-plugins-baseUpgrade clutter-gst2Upgrade gstreamer-plugins-bad-free-develUpgrade gstreamer1Upgrade orc-compilerUpgrade gstreamer-plugins-goodUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-base-devel-docsUpgrade gnome-video-effectsUpgrade gstreamer1-debuginfoUpgrade orc-debuginfoUpgrade gstreamer-plugins-bad-free-devel-docsUpgrade gstreamer-plugins-bad-free | Aug 3, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade typelib-1_0-gstapp-1_0Upgrade typelib-1_0-GstRiff-1_0Upgrade typelib-1_0-gsttag-1_0Upgrade libgstaudio-1_0-0-32bitUpgrade typelib-1_0-gst-1_0Upgrade gstreamer-develUpgrade typelib-1_0-gstrtsp-1_0Upgrade libgstapp-1_0-0Upgrade typelib-1_0-gstallocators-1_0Upgrade gstreamerUpgrade libgsttag-1_0-0-32bitUpgrade gstreamer-plugins-baseUpgrade typelib-1_0-gstvideo-1_0Upgrade typelib-1_0-GstFft-1_0Upgrade typelib-1_0-gstaudio-1_0Upgrade typelib-1_0-gstpbutils-1_0Upgrade libgstsdp-1_0-0Upgrade libgstreamer-1_0-0Upgrade gstreamer-plugins-base-langUpgrade libgstrtsp-1_0-0Upgrade libgstfft-1_0-0-32bitUpgrade gstreamer-langUpgrade libgstriff-1_0-0Upgrade typelib-1_0-gstsdp-1_0Upgrade libgstrtp-1_0-0Upgrade libgstpbutils-1_0-0Upgrade libgstallocators-1_0-0Upgrade libgstreamer-1_0-0-32bitUpgrade typelib-1_0-gstrtp-1_0Upgrade libgsttag-1_0-0Upgrade libgstapp-1_0-0-32bitUpgrade libgstfft-1_0-0Upgrade libgstvideo-1_0-0Upgrade libgstpbutils-1_0-0-32bitUpgrade gstreamer-utilsUpgrade libgstvideo-1_0-0-32bitUpgrade gstreamer-plugins-base-develUpgrade libgstaudio-1_0-0 | Mar 1, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade gstreamer1.0-plugins-baseUpgrade gstreamer0.10-plugins-base | Mar 28, 2017 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub