Bug 1024041 – VUL-1: CVE-2017-5842: gstreamer-plugins-base: Out-of-bounds heap read in html_context_handle_element

Bug 1024041 - (CVE-2017-5842) VUL-1: CVE-2017-5842: gstreamer-plugins-base: Out-of-bounds heap read in html_context_handle_element

(CVE-2017-5842)
Summary:	VUL-1: CVE-2017-5842: gstreamer-plugins-base: Out-of-bounds heap read in html...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assigned To:	Antonio Larrosa
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/179851/
Whiteboard:	CVSSv2:SUSE:CVE-2017-5842:4.3:(AV:N/A...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-02-07 13:59 UTC by Matthias Gerstner
Modified:	2017-07-11 15:18 UTC (History)
CC List:	7 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Matthias Gerstner 2017-02-07 13:59:40 UTC

A crafted SAMI subtitle file can cause a one byte out of bounds heap access.

upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=777502
upstream commit: https://github.com/GStreamer/gst-plugins-base/commit/d894c19

acknowledgments: Hanno Böck

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1419591
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5842
http://seclists.org/oss-sec/2017/q1/284
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5842.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5842
https://bugzilla.gnome.org/show_bug.cgi?id=777957
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Comment 1 Matthias Gerstner 2017-02-07 14:04:33 UTC

I've found the following affected sources:

[affected]

SUSE:SLE-12-SP2:Update/gstreamer-plugins-base/gst-plugins-base-1.8.3/gst/subparse/samiparse.c:507
SUSE:SLE-12:Update/gstreamer-plugins-base/gst-plugins-base-1.2.4/gst/subparse/samiparse.c:500

[not affected]

gstreamer 0.10 also has a samiparse.c, but not the affected function, valgrind
shows no errors.

openSUSE:Leap:42.2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-11-SP1:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.25/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-11-SP2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.35/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-12:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-12-SP2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())

QA reproducer:

Using the PoC file https://samples.mplayerhq.hu/sub/sami/OneNote_Manager.smi
I've been able to reproduce the issue von SLES-12-SP2 like this:

  valgrind gst-discoverer-1.0 OneNote_Manager.smi

valgrind shows an invalid read access of size 1.

Comment 2 Swamp Workflow Management 2017-02-07 23:01:49 UTC

bugbot adjusting priority

Comment 4 Bernhard Wiedemann 2017-02-20 11:02:11 UTC

This is an autogenerated message for OBS integration:
This bug (1024041) was mentioned in
https://build.opensuse.org/request/show/459181 42.1 / gstreamer-plugins-base

Comment 5 Swamp Workflow Management 2017-02-28 23:08:13 UTC

openSUSE-SU-2017:0574-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
openSUSE Leap 42.1 (src):    gstreamer-plugins-base-1.4.5-8.1

Comment 6 Swamp Workflow Management 2017-04-18 13:08:53 UTC

SUSE-SU-2017:1039-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Server 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Desktop 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11

Comment 7 Swamp Workflow Management 2017-04-18 13:10:46 UTC

SUSE-SU-2017:1041-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Server 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Desktop 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8

Comment 8 Swamp Workflow Management 2017-04-26 16:10:27 UTC

openSUSE-SU-2017:1106-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
openSUSE Leap 42.2 (src):    gstreamer-plugins-base-1.8.3-5.3.2

Comment 9 Johannes Segitz 2017-07-11 15:18:13 UTC

fixed