Live555: Security Vulnerabilities
A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
CVSS Score
9.8
EPSS Score
0.003
Published
2024-01-12
Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.
CVSS Score
7.5
EPSS Score
0.004
Published
2022-07-12
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
CVSS Score
7.5
EPSS Score
0.004
Published
2021-08-18
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
CVSS Score
5.5
EPSS Score
0.001
Published
2021-08-18
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
CVSS Score
7.5
EPSS Score
0.005
Published
2021-08-10
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
CVSS Score
6.5
EPSS Score
0.003
Published
2021-08-10
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
CVSS Score
6.5
EPSS Score
0.003
Published
2021-08-10
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
CVSS Score
7.5
EPSS Score
0.004
Published
2021-04-29
In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.
CVSS Score
9.8
EPSS Score
0.004
Published
2021-01-11
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
CVSS Score
9.8
EPSS Score
0.005
Published
2019-08-20
Page 1