CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-6095
https://notcve.org/view.php?id=CVE-2020-6095
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability. Se presenta una vulnerabilidad de denegación de servicio explotable en la funcionalidad GstRTSPAuth de GStreamer/gst-rtsp-server versión 1.14.5. Una petición de configuración RTSP especialmente diseñada puede causar una deferencia del puntero null resultando en una denegación de servicio. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00029.html https://gitlab.freedesktop.org/gstreamer/gst-rtsp-server/-/commit/44ccca3086dd81081d72ca0b21d0ecdde962fb1a https://security.gentoo.org/glsa/202009-05 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1018 • CWE-476: NULL Pointer Dereference CWE-690: Unchecked Return Value to NULL Pointer Dereference •
CVSS: 8.8EPSS: 3%CPEs: 6EXPL: 0CVE-2019-9928
https://notcve.org/view.php?id=CVE-2019-9928
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution. GStreamer anterior a la versión 1.16.0 presenta una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap) en el parser de conexión RTSP mediante una respuesta de servidor especialmente diseñada, lo que permite potencialmente la ejecución remota de código. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00078.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00082.html http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00049.html https://gstreamer.freedesktop.org/security https://gstreamer.freedesktop.org/security/sa-2019-0001.html https://lists.debian.org/debian-lts-announce/2019/04/msg00030.html https://lists.debian.org/debian-lts-announce/2019/04/msg00031.html https://seclists.org/bugtraq/2019/Apr& • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2017-5846
https://notcve.org/view.php?id=CVE-2017-5846
The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file. La función gst_asf_demux_process_ext_stream_props en gst/asfdemux/gstasfdemux.c en gst-plugins-ugly en GStreamer en versiones anteriores a 1.10.3 permite a atacantes remotos provocar una denegación de servicio (lectura de memoria no válida y caída) a través de vectores relacionados con el número de idiomas en un archivo de vídeo. • http://www.debian.org/security/2017/dsa-3821 http://www.openwall.com/lists/oss-security/2017/02/01/7 http://www.openwall.com/lists/oss-security/2017/02/02/9 http://www.securityfocus.com/bid/96001 https://bugzilla.gnome.org/show_bug.cgi?id=777937 https://gstreamer.freedesktop.org/releases/1.10/#1.10.3 https://lists.debian.org/debian-lts-announce/2020/05/msg00030.html https://security.gentoo.org/glsa/201705-10 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 3%CPEs: 3EXPL: 0CVE-2017-5847
https://notcve.org/view.php?id=CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors. La función gst_asf_demux_process_ext_content_desc en gst/asfdemux/gstasfdemux.c en gst-plugins-ugly en GStreamer permite a atacantes remotos provocar una denegación de servicio (lectura de memoria dinámica fuera de límites) a través de vectores que implican descriptores de contenido extendidos. • http://www.debian.org/security/2017/dsa-3821 http://www.openwall.com/lists/oss-security/2017/02/01/7 http://www.openwall.com/lists/oss-security/2017/02/02/9 http://www.securityfocus.com/bid/96001 https://bugzilla.gnome.org/show_bug.cgi?id=777955#c3 https://github.com/GStreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37 https://lists.debian.org/debian-lts-announce/2020/05/msg00030.html https://security.gentoo.org/glsa/201705-10 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-10198 – gstreamer-plugins-good: Invalid memory read in gst_aac_parse_sink_setcaps
https://notcve.org/view.php?id=CVE-2016-10198
The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file. La función gst_aac_parse_sink_setcaps en gst/audioparsers/gstaacparse.c en gst-plugins-good en GStreamer en versiones anteriores a 1.10.3 permite a atacantes remotos provocar una denegación de servicio (lectura de memoria no válida y caída) a través de un archivo de audio manipulado. • http://www.debian.org/security/2017/dsa-3820 http://www.openwall.com/lists/oss-security/2017/02/01/7 http://www.openwall.com/lists/oss-security/2017/02/02/9 http://www.securityfocus.com/bid/96001 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=775450 https://gstreamer.freedesktop.org/releases/1.10/#1.10.3 https://lists.debian.org/debian-lts-announce/2020/05/msg00029.html https://security.gentoo.org/glsa/201705- • CWE-125: Out-of-bounds Read •