The remote host is affected by the vulnerability described in GLSA-201705-10 (GStreamer plug-ins: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in various GStreamer       plug-ins. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system using a       GStreamer plug-in to process a specially crafted file, resulting in the       execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update for gstreamer-0_10-plugins-base fixes the following issues :

  - A crafted AVI file could have caused a floating point     exception leading to DoS (bsc#1024076, CVE-2017-5837,     bsc#1024079, CVE-2017-5844)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gstreamer packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in gstreamer1,     gstreamer1-plugins-base, gstreamer1-plugins-good, and     gstreamer1-plugins-bad-free packages. An attacker could     potentially use these flaws to crash applications which     use the GStreamer framework. (CVE-2016-9446,     CVE-2016-9810, CVE-2016-9811, CVE-2016-10198,     CVE-2016-10199, CVE-2017-5837, CVE-2017-5838,     CVE-2017-5839, CVE-2017-5840, CVE-2017-5841,     CVE-2017-5842, CVE-2017-5843, CVE-2017-5844,     CVE-2017-5845, CVE-2017-5848)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2060 advisory.

    clutter-gst2     [2.0.18-1]
    - Update to 2.0.18
    - Remove obsolete patches
    - Use license macro for COPYING
    - Resolves: #1386833

    gnome-video-effects     [0.4.3-1]
    - Update to 0.4.3
    - Resolves: #1386968

    [0.4.1-5]
    - Fix URL (rhbz#1380981)

    gstreamer-plugins-bad-free     [0.10.23-23]
    - Rebuild with hardened flags     Resolves: #1420764

    gstreamer-plugins-good     [0.10.31-13]
    - Rebuild with correct hardening flags       Resolves: #1420765

    gstreamer1     [1.10.4-2]
    - fix origin
    - Resolves: #1420650

    [1.10.4-1]
    - Update to 1.10.4
    - update patches
    - Resolves: #1420650

    gstreamer1-plugins-bad-free     [1.10.4-2]
    - Disable plugins
    - Fix origin
    - Resolves: #1429587

    [1.10.4-1]
    - Update to 1.10.4
    - Remove unbuilt plugins
    - Resolves: #1429587

    gstreamer1-plugins-base     [1.10.4-1]
    - Update to 1.10.4
    - Resolves: #1428918

    [1.4.5-3]
    - Fix unit test on ppc64
    - Resolves: #1265905

    gstreamer1-plugins-good     [1.10.4-2]
    - Fix origin       Resolves: #1429577

    [1.10.4-1]
    - Update to 1.10.4       Resolves: #1429577

    orc     [0.4.26-1]
    - Update to 0.4.26
    - Remove upstreamed patches
    - Resolves: #1430051

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2179:01 advisory.

    clutter-gst2     Clutter is an open source software library for creating fast, visually     rich and animated graphical user interfaces.
    Clutter GStreamer enables the use of GStreamer with Clutter.
    gnome-video-effects     A collection of GStreamer effects to be used in different GNOME Modules.
    gstreamer1     GStreamer is a streaming media framework, based on graphs of filters which     operate on media data. Applications using this library can do anything     from real-time sound processing to playing videos, and just about anything     else media-related.  Its plugin-based architecture means that new data     types or processing capabilities can be added simply by installing new     plugins.
    gstreamer1-plugins-bad-free     GStreamer is a streaming media framework, based on graphs of elements which     operate on media data.
    This package contains plug-ins that aren't tested well enough, or the code     is not of good enough quality.
    gstreamer1-plugins-base     GStreamer is a streaming media framework, based on graphs of filters which     operate on media data. Applications using this library can do anything     from real-time sound processing to playing videos, and just about anything     else media-related.  Its plugin-based architecture means that new data     types or processing capabilities can be added simply by installing new     plug-ins.
    This package contains a set of well-maintained base plug-ins.
    gstreamer1-plugins-good     GStreamer is a streaming media framework, based on graphs of filters which     operate on media data. Applications using this library can do anything     from real-time sound processing to playing videos, and just about anything     else media-related.  Its plugin-based architecture means that new data     types or processing capabilities can be added simply by installing new     plugins.
    GStreamer Good Plugins is a collection of well-supported plugins of     good quality and under the LGPL license.
    gstreamer-plugins-bad-free     GStreamer is a streaming media framework, based on graphs of elements which     operate on media data.
    This package contains plug-ins that aren't tested     well enough, or the code is not of good enough quality.
    gstreamer-plugins-good     GStreamer is a streaming media framework, based on graphs of filters which     operate on media data. Applications using this library can do anything     from real-time sound processing to playing videos, and just about anything     else media-related.  Its plugin-based architecture means that new data     types or processing capabilities can be added simply by installing new     plug-ins.
    GStreamer Good Plug-ins is a collection of well-supported plug-ins of     good quality and under the LGPL license.
    orc     Orc is a library and set of tools for compiling and executing     very simple programs that operate on arrays of data.  The language     is a generic assembly language that represents many of the features     available in SIMD architectures, including saturated addition and     subtraction, and many arithmetic operations.
    CVE-2016-1019     Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to     cause a denial of service (application crash) or possibly execute     arbitrary code via unspecified vectors, as exploited in the wild in     April 2016.
    CVE-2016-9446     The vmnc decoder in the gstreamer does not initialize the render     canvas, which allows remote attackers to obtain sensitive information     as demonstrated by thumbnailing a simple 1 frame vmnc movie that does     not draw to the allocated render canvas.
    CVE-2016-9810     The gst_decode_chain_free_internal function in the flxdex decoder in     gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to     cause a denial of service (invalid memory read and crash) via an     invalid file, which triggers an incorrect unref call.
    CVE-2016-9811     The windows_icon_typefind function in gst-plugins-base in GStreamer     before 1.10.2, when G_SLICE is set to always-malloc, allows remote     attackers to cause a denial of service (out-of-bounds read) via a     crafted ico file.
    CVE-2017-5837     The gst_riff_create_audio_caps function in     gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before     1.10.3 allows remote attackers to cause a denial of service (floating     point exception and crash) via a crafted video file.
    CVE-2017-5838     The gst_date_time_new_from_iso8601_string function in     gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers     to cause a denial of service (out-of-bounds heap read) via a malformed     datetime string.
    CVE-2017-5839     The gst_riff_create_audio_caps function in     gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before     1.10.3 does not properly limit recursion, which allows remote     attackers to cause a denial of service (stack overflow and crash) via     vectors involving nested WAVEFORMATEX.
    CVE-2017-5840     The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in     gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to     cause a denial of service (out-of-bounds heap read) via vectors     involving the current stts index.
    CVE-2017-5841     The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in     gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to     cause a denial of service (out-of-bounds heap read) via vectors     involving ncdt tags.
    CVE-2017-5842     The html_context_handle_element function in gst/subparse/samiparse.c     in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers     to cause a denial of service (out-of-bounds write) via a crafted SMI     file, as demonstrated by OneNote_Manager.smi.
    CVE-2017-5843     Multiple use-after-free vulnerabilities in the (1)     gst_mini_object_unref, (2) gst_tag_list_unref, and (3)     gst_mxf_demux_update_essence_tracks functions in GStreamer before     1.10.3 allow remote attackers to cause a denial of service (crash) via     vectors involving stream tags, as demonstrated by 02785736.mxf.
    CVE-2017-5844     The gst_riff_create_audio_caps function in     gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before     1.10.3 allows remote attackers to cause a denial of service (floating     point exception and crash) via a crafted ASF file.
    CVE-2017-5845     The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in     gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to     cause a denial of service (invalid memory read and crash) via a ncdt     sub-tag that goes behind the surrounding tag.
    CVE-2017-5848     The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in     gst-plugins-bad in GStreamer allows remote attackers to cause a denial     of service (invalid memory read and crash) via vectors involving PSM     parsing.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that it is possible to trigger a floating point exception in GStreamer via specially crafted files, causing a denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 0.10.36-1.1+deb7u2.

We recommend that you upgrade your gst-plugins-base0.10 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-0_10-plugins-base fixes the following security issues :

  - A crafted AVI file could have caused a floating point     exception leading to DoS (bsc#1024076, CVE-2017-5837,     bsc#1024079, CVE-2017-5844)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-0_10-plugins-base fixes the following issues :

  - A crafted AVI file could have caused a floating point     exception leading to DoS (bsc#1024076, CVE-2017-5837,     bsc#1024079, CVE-2017-5844)

This update was imported from the SUSE:SLE-12:Update update project.

This update for gstreamer-plugins-base fixes the following security issues :

  - A crafted AVI file could have caused a floating point     exception leading to DoS (bsc#1024076, CVE-2017-5837,     bsc#1024079, CVE-2017-5844)

  - A crafted AVI file could have caused a stack overflow     leading to DoS (bsc#1024047, CVE-2017-5839)

  - A crafted SAMI subtitle file could have caused an     invalid memory access possibly leading to DoS or     corruption (bsc#1024041, CVE-2017-5842)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2060 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data.

    The following packages have been upgraded to a later upstream version: clutter-gst2 (2.0.18), gnome-video-     effects (0.4.3), gstreamer1 (1.10.4), gstreamer1-plugins-bad-free (1.10.4), gstreamer1-plugins-base     (1.10.4), gstreamer1-plugins-good (1.10.4), orc (0.4.26).

    Security Fix(es):

    * Multiple flaws were found in gstreamer1, gstreamer1-plugins-base, gstreamer1-plugins-good, and     gstreamer1-plugins-bad-free packages. An attacker could potentially use these flaws to crash applications     which use the GStreamer framework. (CVE-2016-9446, CVE-2016-9810, CVE-2016-9811, CVE-2016-10198,     CVE-2016-10199, CVE-2017-5837, CVE-2017-5838, CVE-2017-5839, CVE-2017-5840, CVE-2017-5841, CVE-2017-5842,     CVE-2017-5843, CVE-2017-5844, CVE-2017-5845, CVE-2017-5848)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following packages have been upgraded to a later upstream version:
clutter-gst2 (2.0.18), gnome-video-effects (0.4.3), gstreamer1 (1.10.4), gstreamer1-plugins-bad-free (1.10.4), gstreamer1-plugins-base (1.10.4), gstreamer1-plugins-good (1.10.4), orc (0.4.26).

Security Fix(es) :

  - Multiple flaws were found in gstreamer1,     gstreamer1-plugins-base, gstreamer1-plugins-good, and     gstreamer1-plugins-bad-free packages. An attacker could     potentially use these flaws to crash applications which     use the GStreamer framework. (CVE-2016-9446,     CVE-2016-9810, CVE-2016-9811, CVE-2016-10198,     CVE-2016-10199, CVE-2017-5837, CVE-2017-5838,     CVE-2017-5839, CVE-2017-5840, CVE-2017-5841,     CVE-2017-5842, CVE-2017-5843, CVE-2017-5844,     CVE-2017-5845, CVE-2017-5848)

Some isses have been found in gst-plugins-base0.10, a package that provides GStreamer plugins from the 'base' set. All issues are related to crafted ico-files that could result in an out-of-bounds read or crafted video- and ASDF-files that could produce floating point exceptions, which could cause a denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 0.10.36-2+deb8u2.

We recommend that you upgrade your gst-plugins-base0.10 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened.

An update is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data.

The following packages have been upgraded to a later upstream version:
clutter-gst2 (2.0.18), gnome-video-effects (0.4.3), gstreamer1 (1.10.4), gstreamer1-plugins-bad-free (1.10.4), gstreamer1-plugins-base (1.10.4), gstreamer1-plugins-good (1.10.4), orc (0.4.26).

Security Fix(es) :

* Multiple flaws were found in gstreamer1, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-bad-free packages. An attacker could potentially use these flaws to crash applications which use the GStreamer framework. (CVE-2016-9446, CVE-2016-9810, CVE-2016-9811, CVE-2016-10198, CVE-2016-10199, CVE-2017-5837, CVE-2017-5838, CVE-2017-5839, CVE-2017-5840, CVE-2017-5841, CVE-2017-5842, CVE-2017-5843, CVE-2017-5844, CVE-2017-5845, CVE-2017-5848)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100263	GLSA-201705-10 : GStreamer plug-ins: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2017/5/18	2025/12/18	critical
99397	SUSE SLED12 / SLES12 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2017:1012-1)	Nessus	SuSE Local Security Checks	2017/4/14	2025/12/25	medium
103064	EulerOS 2.0 SP2 : gstreamer (EulerOS-SA-2017-1206)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	high
180851	Oracle Linux 7 : GStreamer (ELSA-2017-2060)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
290002	MiracleLinux 7 : GStreamer (AXSA:2017-2179:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	critical
97232	Debian DLA-827-1 : gst-plugins-base0.10 security update	Nessus	Debian Local Security Checks	2017/2/21	2026/1/1	medium
99393	SUSE SLED12 / SLES12 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2017:1003-1)	Nessus	SuSE Local Security Checks	2017/4/14	2025/12/25	medium
99561	openSUSE Security Update : gstreamer-0_10-plugins-base (openSUSE-2017-502)	Nessus	SuSE Local Security Checks	2017/4/21	2025/12/23	medium
99701	openSUSE Security Update : gstreamer-plugins-base (openSUSE-2017-512)	Nessus	SuSE Local Security Checks	2017/4/27	2025/12/23	high
102150	RHEL 7 : GStreamer (RHSA-2017:2060)	Nessus	Red Hat Local Security Checks	2017/8/3	2025/4/15	high
102659	Scientific Linux Security Update : GStreamer on SL7.x x86_64 (20170802)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	high
134177	Debian DLA-2126-1 : gst-plugins-base0.10 security update	Nessus	Debian Local Security Checks	2020/3/2	2024/3/25	medium
99005	Debian DSA-3819-1 : gst-plugins-base1.0 - security update	Nessus	Debian Local Security Checks	2017/3/28	2025/12/29	high
102752	CentOS 7 : clutter-gst2 / gnome-video-effects / gstreamer-plugins-bad-free / etcgstreamer1 / etc (CESA-2017:2060)	Nessus	CentOS Local Security Checks	2017/8/25	2025/11/25	high

检测

插件搜索

critical

medium

high

high

critical

medium

medium

medium

high

high

high

medium

high

high