Bug 1024041 - (CVE-2017-5842) VUL-1: CVE-2017-5842: gstreamer-plugins-base: Out-of-bounds heap read in html_context_handle_element
(CVE-2017-5842)
VUL-1: CVE-2017-5842: gstreamer-plugins-base: Out-of-bounds heap read in html...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Antonio Larrosa
Security Team bot
https://smash.suse.de/issue/179851/
CVSSv2:SUSE:CVE-2017-5842:4.3:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-02-07 13:59 UTC by Matthias Gerstner
Modified: 2017-07-11 15:18 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Matthias Gerstner 2017-02-07 14:04:33 UTC
I've found the following affected sources:

[affected]

SUSE:SLE-12-SP2:Update/gstreamer-plugins-base/gst-plugins-base-1.8.3/gst/subparse/samiparse.c:507
SUSE:SLE-12:Update/gstreamer-plugins-base/gst-plugins-base-1.2.4/gst/subparse/samiparse.c:500

[not affected]

gstreamer 0.10 also has a samiparse.c, but not the affected function, valgrind
shows no errors.

openSUSE:Leap:42.2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-11-SP1:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.25/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-11-SP2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.35/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-12:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())
SUSE:SLE-12-SP2:Update/gstreamer-0_10-plugins-base/gst-plugins-base-0.10.36/gst/subparse/samiparse.c (no html_context_handle_element())

QA reproducer:

Using the PoC file https://samples.mplayerhq.hu/sub/sami/OneNote_Manager.smi
I've been able to reproduce the issue von SLES-12-SP2 like this:

  valgrind gst-discoverer-1.0 OneNote_Manager.smi

valgrind shows an invalid read access of size 1.
Comment 2 Swamp Workflow Management 2017-02-07 23:01:49 UTC
bugbot adjusting priority
Comment 4 Bernhard Wiedemann 2017-02-20 11:02:11 UTC
This is an autogenerated message for OBS integration:
This bug (1024041) was mentioned in
https://build.opensuse.org/request/show/459181 42.1 / gstreamer-plugins-base
Comment 5 Swamp Workflow Management 2017-02-28 23:08:13 UTC
openSUSE-SU-2017:0574-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
openSUSE Leap 42.1 (src):    gstreamer-plugins-base-1.4.5-8.1
Comment 6 Swamp Workflow Management 2017-04-18 13:08:53 UTC
SUSE-SU-2017:1039-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Server 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
SUSE Linux Enterprise Desktop 12-SP2 (src):    gstreamer-plugins-base-1.8.3-12.11
Comment 7 Swamp Workflow Management 2017-04-18 13:10:46 UTC
SUSE-SU-2017:1041-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Server 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
SUSE Linux Enterprise Desktop 12-SP1 (src):    gstreamer-plugins-base-1.2.4-2.6.8
Comment 8 Swamp Workflow Management 2017-04-26 16:10:27 UTC
openSUSE-SU-2017:1106-1: An update that fixes four vulnerabilities is now available.

Category: security (low)
Bug References: 1024041,1024047,1024076,1024079
CVE References: CVE-2017-5837,CVE-2017-5839,CVE-2017-5842,CVE-2017-5844
Sources used:
openSUSE Leap 42.2 (src):    gstreamer-plugins-base-1.8.3-5.3.2
Comment 9 Johannes Segitz 2017-07-11 15:18:13 UTC
fixed