{"id":"CVE-2019-9928","aliases":["ALPINE-CVE-2019-9928","BELL-CVE-2019-9928","DEBIAN-CVE-2019-9928","DLA-1769-1","DLA-1770-1","DSA-4437-1","EUVD-2019-19283","GHSA-4c4c-7hrr-jfv2","SUSE-SU-2019:14076-1","SUSE-SU-2019:1508-1","SUSE-SU-2019:1509-1","SUSE-SU-2019:1600-1","SUSE-SU-2019:1602-1","SUSE-SU-2020:1300-1","SUSE-SU-2020:1300-2","UBUNTU-CVE-2019-9928","USN-3958-1","openSUSE-SU-2020:0678-1","openSUSE-SU-2024:10828-1"],"status":"published","title":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a...","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05935,"percentile":0.9331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-04-24T00:00:00Z","modified":"2026-10-24T10:31:03Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-base","fixed_in":["1.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gst-plugins-base","fixed_in":["1.14.4-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-base1.0","fixed_in":["1.14.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-base1.0","fixed_in":["1.14.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-base1.0","fixed_in":["1.14.4-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gst-plugins-base0.10","fixed_in":["0.10.36-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gst-plugins-base1.0","fixed_in":["1.4.4-2+deb8u2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gst-plugins-base1.0","fixed_in":["1.10.4-1+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gstreamer-plugins-base","fixed_in":["1.2.4-2.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.2.4-2.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.2.4-2.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"gstreamer-plugins-base","fixed_in":["1.12.5-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","fixed_in":["0.10.36-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.8.3-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.14.1-1ubuntu1~ubuntu18.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"gstreamer-plugins-base","fixed_in":["1.12.5-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-base","fixed_in":["1.18.5-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-2+deb8u1"}]}],"versions":["0.10.36-2"]},{"source":"osv","ecosystem":"Debian:8","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-2+deb8u2"}]}],"versions":["1.4.4-2","1.4.4-2+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1+deb9u1"}]}],"versions":["1.10.4-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.35-5.18.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.35-5.18.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-2.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-2.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-2.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-2ubuntu0.2"}]}],"versions":["0.10.36-2","0.10.36-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1ubuntu1~ubuntu18.04.2"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base0.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-2ubuntu0.2"}]}],"versions":["0.10.36-2","0.10.36-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1ubuntu1~ubuntu18.04.2"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.5-2.1"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gstreamer","product":"gstreamer"}],"references":[{"url":"https://gstreamer.freedesktop.org/security/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2019-0001.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00030.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3958-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Apr/39","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4437","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-33","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9928"},{"url":"https://gstreamer.freedesktop.org/security"},{"url":"https://usn.ubuntu.com/3958-1"},{"url":"https://github.com/advisories/GHSA-4c4c-7hrr-jfv2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9928","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-9928","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9928","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914076-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1024076","tags":["report"]},{"url":"https://bugzilla.suse.com/1024079","tags":["report"]},{"url":"https://bugzilla.suse.com/1133375","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9928","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191508-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191509-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191600-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191602-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201300-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201300-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9928","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3958-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9928","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNWCEFRK4SWZUYPTV47AYSJUFUPXN2KE/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T14:48:24Z","modified":"2024-08-04T22:01:55.184Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19283","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T14:48:24Z","modified":"2024-08-04T22:01:55Z","updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-4c4c-7hrr-jfv2","title":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a...","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2022-05-24T16:44:35Z","modified":"2024-04-04T00:05:20Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:55:49.472376Z"}],"nvd":[{"id":"CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T15:29:02.293Z","modified":"2026-06-17T02:44:52.073Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"ALPINE-CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T15:29:02.293Z","modified":"2026-09-21T06:17:52.561463487Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2019-9928","title":"CVE-2019-9928 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:12.353507Z","modified":"2026-01-26T09:47:28.748614Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T15:29:02.293Z","modified":"2026-10-24T10:31:03.504947108Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T15:29:02.293Z","modified":"2026-09-21T07:03:27.123819428Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-9928","description":"GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.","status":"published","published":"2019-04-24T00:00:00Z","modified":"2026-04-22T12:25:05.457081Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1769-1","title":"gst-plugins-base0.10 - security update","status":"published","published":"2019-04-28T00:00:00Z","modified":"2026-03-09T01:21:55.004081Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1770-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2019-04-28T00:00:00Z","modified":"2026-03-09T01:18:49.14839Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4437-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2019-04-29T00:00:00Z","modified":"2026-03-09T02:11:14.682704Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2020:0678-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-05-22T16:16:36Z","modified":"2026-02-04T02:22:17.830278Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10828-1","title":"gstreamer-plugins-base-1.18.5-2.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-base-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:23.694503Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:14076-1","title":"Security update for gstreamer-0_10-plugins-base","description":"This update for gstreamer-0_10-plugins-base fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-5837: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024076).\n- CVE-2017-5844: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024079).\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2019-06-11T08:07:17Z","modified":"2026-02-04T04:09:18.624175Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1508-1","title":"Security update for gstreamer-0_10-plugins-base","description":"This update for gstreamer-0_10-plugins-base fixes the following issue:\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2019-06-14T12:34:18Z","modified":"2026-02-04T03:11:35.217292Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1509-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2019-06-14T14:18:32Z","modified":"2026-02-04T03:58:43.716907Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1600-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2019-06-21T08:20:33Z","modified":"2026-02-04T03:14:22.171137Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1602-1","title":"Security update for gstreamer-0_10-plugins-base","description":"This update for gstreamer-0_10-plugins-base fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2019-06-21T08:23:12Z","modified":"2026-02-04T03:48:00.021633Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:1300-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2020-05-18T05:44:59Z","modified":"2026-02-04T02:23:11.919241Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1300-2","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).\n","status":"published","published":"2020-07-07T11:44:16Z","modified":"2026-02-04T02:54:45.834215Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-3958-1","title":"gst-plugins-base0.10, gst-plugins-base1.0 vulnerability","description":"It was discovered that GStreamer Base Plugins did not correctly handle\ncertain malformed RTSP streams. If a user were tricked into opening a\ncrafted RTSP stream with a GStreamer application, an attacker could cause a\ndenial of service via application crash, or possibly execute arbitrary\ncode.\n","status":"published","published":"2019-04-29T12:11:46Z","modified":"2026-04-22T09:56:06.669915Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}