Description
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.
References (10)
Core 10
Core References
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2017/dsa-3819
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.gnome.org/show_bug.cgi?id=774902
Release Notes, Vendor Advisory x_refsource_confirm
https://gstreamer.freedesktop.org/releases/1.10/#1.10.2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95161
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2060
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/12/05/8
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201705-10
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/12/01/2
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/02/msg00032.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM7IXFGHV66KNWGWG6ZBDNKXD2UJL2VQ/
Scores
CVSS v3
4.7
EPSS
0.0049
EPSS Percentile
65.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (16)
debian/debian_linux
8.0
debian/debian_linux
9.0
fedoraproject/fedora
35
gstreamer/gstreamer
< 1.10.1
redhat/enterprise_linux_desktop
7.0
redhat/enterprise_linux_eus
7.4
redhat/enterprise_linux_eus
7.5
redhat/enterprise_linux_eus
7.6
redhat/enterprise_linux_eus
7.7
redhat/enterprise_linux_server
7.0
... and 6 more
Published
Jan 13, 2017
Tracked Since
Feb 18, 2026