GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9928
Reference (s):
- BUGTRAQ:20190429 [SECURITY] [DSA 4437-1] gst-plugins-base1.0 security update
- URL: https://seclists.org/bugtraq/2019/Apr/39
- https://gstreamer.freedesktop.org/security/
- https://gstreamer.freedesktop.org/security/sa-2019-0001.html
- DEBIAN:DSA-4437