PT-2019-18730 · Live Networks · Live555

Zounathan · Published 2019-02-11 · Updated 2020-08-24 · CVE-2019-7732

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Live555 version 0.95

Description A memory leak can occur due to a setup packet, potentially leading to a denial of service (DoS) because when there are multiple instances of certain fields, such as username, realm, nonce, uri, or response, only the last instance can be freed.

Recommendations For Live555 version 0.95, consider restricting the handling of setup packets to prevent the memory leak until a fix is available. As a temporary workaround, review the code to ensure proper memory management for multiple instances of fields like username, realm, nonce, uri, or response.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2019-7732

Affected Products

Live555

References · 6

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7732 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7732 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7732 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-7732 · Security Note
• https://github.com/rgaufman/live555/issues/20 · Note