PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5842 Gstreamer CVE debrief

CVE-2017-5842 is a denial-of-service vulnerability in GStreamer's gst-plugins-base SMI subtitle parser. A crafted SMI file can trigger an out-of-bounds write in html_context_handle_element, and the issue was fixed in GStreamer 1.10.3. NVD assigns a medium severity score (CVSS 5.5) and lists availability impact as the primary concern.

Vendor
Gstreamer
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Teams running applications or pipelines that parse SMI subtitle files through GStreamer gst-plugins-base, especially desktop media players, transcoders, and any service that ingests untrusted media content.

Technical summary

NVD describes an out-of-bounds write in gst/subparse/samiparse.c, specifically html_context_handle_element, affecting gst-plugins-base versions before 1.10.3. The vulnerable condition is reached while parsing crafted SMI subtitle content. The NVD vector indicates a user-interaction component and high availability impact, consistent with a crash or service interruption rather than a data confidentiality issue.

Defensive priority

Medium. Prioritize remediation if your environment processes untrusted or externally supplied SMI subtitle files; otherwise track as a standard library update during routine maintenance.

Recommended defensive actions

  • Update GStreamer gst-plugins-base to version 1.10.3 or later, as referenced in the vendor release notes.
  • Inventory products and services that embed or depend on GStreamer subtitle parsing and confirm whether SMI handling is enabled.
  • Block or quarantine untrusted SMI subtitle files at ingestion points until patched versions are deployed.
  • If immediate upgrade is not possible, reduce exposure by disabling SMI subtitle parsing where operationally feasible.
  • Validate vendor-specific advisories and package errata for your distribution (for example Debian, Red Hat, or Gentoo) and apply the corresponding fixed package versions.

Evidence notes

The vulnerability description, affected-version range, CWE-787 classification, and CVSS vector come from the supplied NVD record. The supplied references include vendor release notes for 1.10.3, GNOME issue tracking, Debian and Red Hat advisories, and Openwall mailing list posts that document the fix and downstream remediation. This debrief intentionally stays within the supplied corpus and avoids unsupported claims about exploitability beyond crafted SMI-triggered out-of-bounds write and denial of service.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5842 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5842

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5842 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5842

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.