CVE-2019-7314
9.8
CRITICAL · CVSS 3.0 · EPSS 3.2% (pctl 88)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.19% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-416 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-02-04 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| debian | debian linux |
| live555 | streaming media |
References
- http://lists.live555.com/pipermail/live-devel/2019-February/021143.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html
- http://www.live555.com/liveMedia/public/changelog.txt
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
- http://lists.live555.com/pipermail/live-devel/2019-February/021143.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html
- http://www.live555.com/liveMedia/public/changelog.txt
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
→ the Explorer · watch your stack · NVD