8.8

CVE-2019-9928: canonical ubuntu_linux Out-of-bounds Write

Modified
AliasesALPINE-CVE-2019-9928SUSE-SU-2019:1508-1SUSE-SU-2019:1509-1
Published 24-04-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9928 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 5.93% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.0 (NVD)
EPSS score
5.93%
0%100%
Low · -0.03 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2019:14076-1

Timeline

  1. 24-04-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

5.93%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

Decrease -0.03 pp

From 5.96% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse39 products
  • gstreamer-0_10-plugins-base&distro=SUSE Enterprise Storage 4< 0.10.36-18.3.2
  • gstreamer-0_10-plugins-base&distro=SUSE Linux Enterprise Desktop 12 SP3< 0.10.36-18.3.2
  • gstreamer-0_10-plugins-base&distro=SUSE Linux Enterprise Desktop 12 SP4< 0.10.36-18.3.2
  • gstreamer-0_10-plugins-base&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 0.10.36-11.9.1
  • gstreamer-0_10-plugins-base&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 0.10.36-18.3.2
Debian3 products
  • gst-plugins-base0.10< 0.10.36-2+deb8u1
  • gst-plugins-base1.0< 1.14.4-2 | < 1.10.4-1+deb9u1 | < 1.4.4-2+deb8u2
  • debian_linuxEOL8.0 | 9.0
Opensuse2 products
  • gstreamer-plugins-base&distro=openSUSE Leap 15.1< 1.12.5-lp151.3.3.1
  • gstreamer-plugins-base&distro=openSUSE Tumbleweed< 1.18.5-2.1
Ubuntu2 products
  • gst-plugins-base0.10< 0.10.36-2ubuntu0.2
  • gst-plugins-base1.0< 1.8.3-1ubuntu0.3 | < 1.14.1-1ubuntu1~ubuntu18.04.2
Alpine1 product
  • gst-plugins-base< 1.16.0-r0 | < 1.14.4-r1
Canonical1 product
Gstreamer1 product

7 vendors · 49 products

References

25 links
Show all 25 references