CVE-2009-0386
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in...
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
- Record
CVE-2009-0386- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
- Record
CVE-2009-0386- Updated
- 2026-11-02
EUVDEUVD-2009-0390 No score
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
- Record
EUVD-2009-0390- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m22q-2q8g-c2mg No score
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in...
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
- Record
GHSA-m22q-2q8g-c2mg- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVPYSEC-2009-14 No score
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
- Record
PYSEC-2009-14- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-bad0.10Debian:4.0 From an advisory covering 3 CVEs |
before 0.10.3-3.1+etch1, plus listed versions 0.10.3-3.1 |
0.10.3-3.1+etch1 |
gstreamer-pluginsPyPI |
through 0.10.9, through 0.10.10, through 0.10.11 | None known |
gstreamer-plugins-goodRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-good-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-good-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-goodRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-good-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-goodRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-good-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
gstreamer-plugins-good-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.10.9-1.el5_3.1 | 0:0.10.9-1.el5_3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0386 is a high vulnerability (CVSS 9.3) in Gstreamer Good Plug-ins, published February 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.15%, the 94th percentile. No source names a fixed version.
References
securityfocus.com/bid/33405
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10306
secunia.com/advisories/34336
Show 27 moreShow less
trapkit.de/advisories/TKADV2009-003.txt
redhat.com/support/errata/RHSA-2009-0271.html
security.gentoo.org/glsa/glsa-200907-11.xml
vupen.com/english/advisories/2009/0225
lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
bugzilla.redhat.com/show_bug.cgi?id=481267
ubuntu.com/usn/USN-736-1
gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html
openwall.com/lists/oss-security/2009/01/29/3
cgit.freedesktop.org/gstreamer/gst-plugins-good/commit?id=bdc20b9baf13564d9a061343416395f8f9a92b53
mandriva.com/security/advisories?name=MDVSA-2009:035
nvd.nist.gov/vuln/detail/CVE-2009-0386
github.com/advisories/GHSA-m22q-2q8g-c2mg
access.redhat.com/errata/RHSA-2009:0271
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0271.json
cve.org/CVERecord?id=CVE-2009-0386