Description
A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | liblivemedia | 2018.11.26-1 | — |
| Debian 9 | liblivemedia | 2016.11.28-1+deb9u2 | DSA-4408-1 |
| Debian 8 | liblivemedia | 2014.01.13-1+deb8u2 | DLA-1690-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | liblivemedia | 2018.02.18-1ubuntu0.1~esm1 | USN-4853-1 |
| Ubuntu Pro 16.04 LTS | liblivemedia | 2016.02.09-1ubuntu0.1~esm1 | USN-4853-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 | live555 | 2018.12.14-bp150.3.3.1 | openSUSE-SU-2019:0058-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | live555 | 2018.12.14-bp150.3.3.1 | openSUSE-SU-2019:0058-1 |
Advisories 4
- USN-4853-1 liblivemedia vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4408-1 liblivemedia - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1690-1 liblivemedia - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:0058-1 Security update for live555 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [debian-lts-announce] 20190226 [SECURITY] [DLA 1690-1] liblivemedia security update mailing-list
- https://github.com/rgaufman/live555/issues/19
- 20190317 [SECURITY] [DSA 4408-1] liblivemedia security update mailing-list
- DSA-4408 vendor-advisory
- GLSA-202005-06 vendor-advisory