ALPINE-CVE-2016-9809

ALPINE-CVE-2016-9809 PUBLISHED CVSS 7.800000190734863 HIGH

Record from OSV · Published January 13, 2017

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
gst-plugins-bad1	Alpine:v3.5	1.8.3-r0
gst-plugins-bad1	Alpine:v3.4	1.8.3-r0

Risk scores

CVSS 3.0

7.800000190734863

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
Alpine	gst-plugins-bad1
Alpine:v3.5	gst-plugins-bad1	1.5.2-r0, 1.0.1-r0, 1.0.10-r0
Alpine:v3.4	gst-plugins-bad1	1.0.0-r0, 1.0.2-r0, 1.0.1-r0

Timeline

Jan 13, 2017 CVE Published
Nov 19, 2025 CVE Updated
May 1, 2026 Distribution Patch

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln ALPINE-CVE-2016-9809
vulnetix vdb fixes ALPINE-CVE-2016-9809

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2016-9809/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://security.alpinelinux.org/vuln/CVE-2016-9809 advisory

Look up in the Resolve Platform →