PT-2019-6433 · Live Networks+2 · Live555+2

Published 2019-08-16 · Updated 2023-03-29 · CVE-2019-15232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Live555 versions prior to 2019.08.16

Description The issue is related to a Use-After-Free error in the GenericMediaServer::createNewClientSessionWithId function, which can generate the same client session ID in succession. This is mishandled by the MPEG1or2 and Matroska file demultiplexors. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 2019.08.16, update to version 2019.08.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the GenericMediaServer component until a patch is available. Avoid using the createNewClientSessionWithId function in the affected GenericMediaServer component until the issue is resolved.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-06969

CVE-2019-15232

MGASA-2021-0313

OPENSUSE-SU-2021:0915-1

OPENSUSE-SU-2021:0937-1

OPENSUSE-SU-2021_0915-1

OPENSUSE-SU-2024:11023-1

Affected Products

Astra Linux

Live555

Suse

References · 24

• https://osv.dev/vulnerability/openSUSE-SU-2021:0937-1 · Vendor Advisory
• http://live555.com/liveMedia/public/changelog.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06969 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15232 · Security Note
• https://security.gentoo.org/glsa/202005-06 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15232 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0313 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15232 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0915-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15232 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15232 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0313.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory