Live555
by Live555
CVEs (12)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-37117 | Cri | 0.64 | 9.8 | 0.01 | Jan 12, 2024 | A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP. | ||
| CVE-2019-15232 | Cri | 0.64 | 9.8 | 0.02 | Aug 20, 2019 | Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors. | ||
| CVE-2019-7314 | Cri | 0.64 | 9.8 | 0.03 | Feb 4, 2019 | liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. | ||
| CVE-2021-41396 | Hig | 0.49 | 7.5 | 0.01 | Jul 12, 2022 | Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack. | ||
| CVE-2021-39282 | Hig | 0.49 | 7.5 | 0.02 | Aug 18, 2021 | Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files. | ||
| CVE-2021-38380 | Hig | 0.49 | 7.5 | 0.02 | Aug 10, 2021 | Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack. | ||
| CVE-2019-7733 | Hig | 0.49 | 7.5 | 0.02 | Feb 11, 2019 | In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove. | ||
| CVE-2019-7732 | Hig | 0.49 | 7.5 | 0.01 | Feb 11, 2019 | In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed. | ||
| CVE-2021-38382 | Med | 0.42 | 6.5 | 0.01 | Aug 10, 2021 | Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | ||
| CVE-2021-38381 | Med | 0.42 | 6.5 | 0.01 | Aug 10, 2021 | Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | ||
| CVE-2026-41470 | Med | 0.38 | 5.9 | 0.00 | May 19, 2026 | LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a… | ||
| CVE-2021-39283 | Med | 0.36 | 5.5 | 0.01 | Aug 18, 2021 | liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands. |
- risk 0.64cvss 9.8epss 0.01
A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
- risk 0.64cvss 9.8epss 0.02
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- risk 0.64cvss 9.8epss 0.03
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- risk 0.49cvss 7.5epss 0.01
Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.
- risk 0.49cvss 7.5epss 0.02
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
- risk 0.49cvss 7.5epss 0.02
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- risk 0.49cvss 7.5epss 0.02
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove.
- risk 0.49cvss 7.5epss 0.01
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.
- risk 0.42cvss 6.5epss 0.01
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- risk 0.42cvss 6.5epss 0.01
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- risk 0.38cvss 5.9epss 0.00
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a…
- risk 0.36cvss 5.5epss 0.01
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.