Live555
by Live555
CVEs (12)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-4013 | 0.04 | — | 0.09 | Oct 19, 2018 | An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger… | |||
| CVE-2023-37117 | 0.00 | — | 0.01 | Jan 12, 2024 | A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP. | |||
| CVE-2021-41396 | 0.00 | — | 0.01 | Jul 11, 2022 | Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack. | |||
| CVE-2021-39282 | 0.00 | — | 0.02 | Aug 18, 2021 | Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files. | |||
| CVE-2021-38380 | 0.00 | — | 0.02 | Aug 10, 2021 | Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack. | |||
| CVE-2021-38381 | 0.00 | — | 0.01 | Aug 10, 2021 | Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | |||
| CVE-2021-38382 | 0.00 | — | 0.01 | Aug 10, 2021 | Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | |||
| CVE-2019-15232 | 0.00 | — | 0.02 | Aug 19, 2019 | Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors. | |||
| CVE-2019-9215 | 0.00 | — | 0.02 | Feb 28, 2019 | In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. | |||
| CVE-2019-7732 | 0.00 | — | 0.01 | Feb 11, 2019 | In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed. | |||
| CVE-2019-7733 | 0.00 | — | 0.02 | Feb 11, 2019 | In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove. | |||
| CVE-2019-7314 | 0.00 | — | 0.03 | Feb 4, 2019 | liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. |
- CVE-2018-4013Oct 19, 2018risk 0.04cvss —epss 0.09
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger…
- CVE-2023-37117Jan 12, 2024risk 0.00cvss —epss 0.01
A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
- CVE-2021-41396Jul 11, 2022risk 0.00cvss —epss 0.01
Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.
- CVE-2021-39282Aug 18, 2021risk 0.00cvss —epss 0.02
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
- CVE-2021-38380Aug 10, 2021risk 0.00cvss —epss 0.02
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- CVE-2021-38381Aug 10, 2021risk 0.00cvss —epss 0.01
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- CVE-2021-38382Aug 10, 2021risk 0.00cvss —epss 0.01
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- CVE-2019-15232Aug 19, 2019risk 0.00cvss —epss 0.02
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- CVE-2019-9215Feb 28, 2019risk 0.00cvss —epss 0.02
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.
- CVE-2019-7732Feb 11, 2019risk 0.00cvss —epss 0.01
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.
- CVE-2019-7733Feb 11, 2019risk 0.00cvss —epss 0.02
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove.
- CVE-2019-7314Feb 4, 2019risk 0.00cvss —epss 0.03
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.