CVE-2019-9928

GStreamer: heap-based buffer overflow in the RTSP connection parser via crafted server response leading to remote code execution

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.0

Review impact separately from score.

Published · April 22, 2019

Updated · August 8, 2026

Description

GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.

Statement

This issue affects the version of gstreamer-plugins-base and gstreamer1-plugins-base as shipped with Red Hat Enterprise Linux 6, 7 and 8. The security impact has been rated as Moderate by the Red Hat Product Security team.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-122 · Heap-based Buffer Overflow