PT-2019-1687 · Live Networks+2 · Live555+2

Published 2019-02-04 · Updated 2021-03-15 · CVE-2019-7314

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Live555 versions prior to 2019.02.03

Description The issue is related to the mishandling of the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error. This error may cause the RTSP server to crash or have unspecified other impact. The vulnerability can be exploited by a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations For versions prior to 2019.02.03, update to version 2019.02.03 or later to resolve the issue. As a temporary workaround, consider restricting access to the RTSP server to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2019-01281

CVE-2019-7314

DLA-1690-1

DSA-4408-1

MGASA-2019-0121

OPENSUSE-SU-2019:1797-1

OPENSUSE-SU-2019:1880-1

OPENSUSE-SU-2019_1797-1

OPENSUSE-SU-2020:0944-1

OPENSUSE-SU-2020_0944-1

OPENSUSE-SU-2024:11023-1

USN-4853-1

Affected Products

Live555

Suse

Ubuntu

References · 39

• http://lists.live555.com/pipermail/live-devel/2019-February/021143.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0121.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1880-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0121 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7314 · Security Note
• https://osv.dev/vulnerability/USN-4853-1 · Vendor Advisory
• http://live555.com/liveMedia/public/changelog.txt · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0944-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=67111271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7314 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1797-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01281 · Security Note