CVE-2019-9928
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a...
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
CVE-2019-9928- Updated
- 2026-11-02
EUVDEUVD-2019-19283 No score
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
EUVD-2019-19283- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4c4c-7hrr-jfv2
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a...
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
GHSA-4c4c-7hrr-jfv2- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-9928
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
ALPINE-CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2019-9928
CVE-2019-9928 does not affect BellSoft software
- Record
BELL-CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSV
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-9928
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
DEBIAN-CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-9928
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
- Record
UBUNTU-CVE-2019-9928- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0678-1 No score
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0678-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10828-1 No score
gstreamer-plugins-base-1.18.5-2.1 on GA media
These are all security issues fixed in the gstreamer-plugins-base-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10828-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14076-1 No score
Security update for gstreamer-0_10-plugins-base
This update for gstreamer-0_10-plugins-base fixes the following issues:
Security issues fixed:
- CVE-2017-5837: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024076).
- CVE-2017-5844: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024079).
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2019:14076-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1508-1 No score
Security update for gstreamer-0_10-plugins-base
This update for gstreamer-0_10-plugins-base fixes the following issue: Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2019:1508-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1509-1 No score
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2019:1509-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1600-1 No score
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issue: Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2019:1600-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1602-1 No score
Security update for gstreamer-0_10-plugins-base
This update for gstreamer-0_10-plugins-base fixes the following issues:
Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2019:1602-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1300-1 No score
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2020:1300-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1300-2 No score
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed:
- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).
- Record
SUSE-SU-2020:1300-2- Updated
- 2026-11-02
OSVUSN-3958-1 No score
gst-plugins-base0.10, gst-plugins-base1.0 vulnerability
It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams. If a user were tricked into opening a crafted RTSP stream with a GStreamer application, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code.
- Record
USN-3958-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-baseAlpine:v3.10 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.11 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.12 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.13 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.14 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.15 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.16 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.17 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.18 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.19 |
before 1.16.0-r0 | 1.16.0-r0 |
Show 58 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-baseAlpine:v3.20 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.21 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.22 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.23 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.24 |
before 1.16.0-r0 | 1.16.0-r0 |
gst-plugins-baseAlpine:v3.9 |
before 1.14.4-r1 | 1.14.4-r1 |
gst-plugins-base1.0Debian:12 |
before 1.14.4-2 | 1.14.4-2 |
gst-plugins-base1.0Debian:13 |
before 1.14.4-2 | 1.14.4-2 |
gst-plugins-base1.0Debian:14 |
before 1.14.4-2 | 1.14.4-2 |
gst-plugins-base0.10Debian:8 |
before 0.10.36-2+deb8u1, plus listed versions 0.10.36-2 |
0.10.36-2+deb8u1 |
gst-plugins-base1.0Debian:8 |
before 1.4.4-2+deb8u2, plus listed versions 1.4.4-21.4.4-2+deb8u1 |
1.4.4-2+deb8u2 |
gst-plugins-base1.0Debian:9 |
before 1.10.4-1+deb9u1, plus listed versions 1.10.4-1 |
1.10.4-1+deb9u1 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 3 CVEs |
before 0.10.35-5.18.5.1 | 0.10.35-5.18.5.1 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 3 CVEs |
before 0.10.35-5.18.5.1 | 0.10.35-5.18.5.1 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 0.10.36-11.9.1 | 0.10.36-11.9.1 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server 12-LTSS |
before 0.10.36-11.9.1 | 0.10.36-11.9.1 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 0.10.36-11.9.1 | 0.10.36-11.9.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.2.4-2.9.1 | 1.2.4-2.9.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12-LTSS |
before 1.2.4-2.9.1 | 1.2.4-2.9.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 1.2.4-2.9.1 | 1.2.4-2.9.1 |
gstreamer-plugins-baseSUSE:OpenStack Cloud 7 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Desktop 12 SP4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12 SP3 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 12 SP4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-plugins-baseSUSE:Enterprise Storage 4 |
before 1.8.3-13.3.2 | 1.8.3-13.3.2 |
gstreamer-0_10-plugins-baseSUSE:OpenStack Cloud 7 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Desktop 12 SP4 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Server 12 SP2-BCL |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-0_10-plugins-baseSUSE:Enterprise Storage 4 |
before 0.10.36-18.3.2 | 0.10.36-18.3.2 |
gstreamer-plugins-baseSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server 15-LTSS |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Server for SAP Applications 15 |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gstreamer-plugins-baseSUSE:Linux Enterprise Module for Package Hub 15 SP1 |
before 1.12.5-3.3.1 | 1.12.5-3.3.1 |
gst-plugins-base0.10Ubuntu:16.04:LTS |
before 0.10.36-2ubuntu0.2, plus listed versions 0.10.36-20.10.36-2ubuntu0.1 |
0.10.36-2ubuntu0.2 |
gst-plugins-base1.0Ubuntu:16.04:LTS |
before 1.8.3-1ubuntu0.3, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 8 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.11.8.3-1ubuntu0.2 |
1.8.3-1ubuntu0.3 |
gst-plugins-base1.0Ubuntu:18.04:LTS |
before 1.14.1-1ubuntu1~ubuntu18.04.2, plus listed versions 1.12.3-11.12.4-11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.0-2ubuntu11.14.1-1ubuntu1~ubuntu18.04.1 |
1.14.1-1ubuntu1~ubuntu18.04.2 |
gstreamer-plugins-baseopenSUSE:Leap 15.1 |
before 1.12.5-lp151.3.3.1 | 1.12.5-lp151.3.3.1 |
gstreamer-plugins-baseopenSUSE:Tumbleweed |
before 1.18.5-2.1 | 1.18.5-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9928 is a high vulnerability (CVSS 8.8) in Gstreamer, published April 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.93%, the 93rd percentile. Fixed in gst-plugins-base 1.16.0-r0.
References
gstreamer.freedesktop.org/security
lists.debian.org/debian-lts-announce/2019/04/msg00031.html
usn.ubuntu.com/3958-1
seclists.org/bugtraq/2019/Apr/39
Show 27 moreShow less
debian.org/security/2019/dsa-4437
lists.opensuse.org/opensuse-security-announce/2019-06/msg00082.html
security.gentoo.org/glsa/202003-33
nvd.nist.gov/vuln/detail/CVE-2019-9928
github.com/advisories/GHSA-4c4c-7hrr-jfv2
security.alpinelinux.org/vuln/CVE-2019-9928
docs.bell-sw.com/security/cves/CVE-2019-9928
security-tracker.debian.org/tracker/CVE-2019-9928
suse.com/support/update/announcement/2019/suse-su-201914076-1
bugzilla.suse.com/1024076
ubuntu.com/security/CVE-2019-9928
cve.org/CVERecord?id=CVE-2019-9928