CVE-2019-6256

Debian Bug report logs - #919529
CVE-2019-6256

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2019-6256

Date: Wed, 16 Jan 2019 23:19:45 +0100

Source: liblivemedia
Severity: grave
Tags: security

Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256

Cheers,
        Moritz

Message #10 received at 919529@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 919529@bugs.debian.org

Subject: Re: Bug#919529: CVE-2019-6256

Date: Thu, 17 Jan 2019 00:00:13 +0100

[Message part 1 (text/plain, inline)]

Control: found -1 2016.11.28-1

On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> Source: liblivemedia
> Severity: grave
> Tags: security
> 
> Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> 
> Cheers,
>         Moritz

Not sure if I'm missing something, but the PoC does not seem to work on
buster/sid. On stretch I get segfaults, but only if I abort the PoC. So marking
as found in stable and closing for sid.

Cheers
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 919529-done@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 919529-done@bugs.debian.org

Subject: Re: Bug#919529: CVE-2019-6256

Date: Thu, 17 Jan 2019 00:01:38 +0100

[Message part 1 (text/plain, inline)]

Version: 2018.11.26-1

On 2019-01-17 00:00:13, Sebastian Ramacher wrote:
> Control: found -1 2016.11.28-1
> 
> On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> > Source: liblivemedia
> > Severity: grave
> > Tags: security
> > 
> > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> > 
> > Cheers,
> >         Moritz
> 
> Not sure if I'm missing something, but the PoC does not seem to work on
> buster/sid. On stretch I get segfaults, but only if I abort the PoC. So marking
> as found in stable and closing for sid.

The actual mail to close the bug for sid.
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 919529@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Sebastian Ramacher <sramacher@debian.org>

Cc: 919529@bugs.debian.org

Subject: Re: Bug#919529: CVE-2019-6256

Date: Thu, 17 Jan 2019 22:46:25 +0100

On Thu, Jan 17, 2019 at 12:00:13AM +0100, Sebastian Ramacher wrote:
> Control: found -1 2016.11.28-1
> 
> On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> > Source: liblivemedia
> > Severity: grave
> > Tags: security
> > 
> > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> > 
> > Cheers,
> >         Moritz
> 
> Not sure if I'm missing something, but the PoC does not seem to work on
> buster/sid.

Quite possible, I hadn't reproduced it myself yet and upstream homepage
wasn't that obvious wrt existing fixes.

Cheers,
        Moritz

Message #31 received at 919529@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Sebastian Ramacher <sramacher@debian.org>, 919529@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#919529: CVE-2019-6256

Date: Sat, 19 Jan 2019 22:36:05 +0100

Hey!

On Thu, Jan 17, 2019 at 12:00:13AM +0100, Sebastian Ramacher wrote:
> Control: found -1 2016.11.28-1
> 
> On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> > Source: liblivemedia
> > Severity: grave
> > Tags: security
> > 
> > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> > 
> > Cheers,
> >         Moritz
> 
> Not sure if I'm missing something, but the PoC does not seem to work on
> buster/sid. On stretch I get segfaults, but only if I abort the PoC. So marking
> as found in stable and closing for sid.

Not having a poc triggering does not necessarly mean the issue needs
to be fixed. Do we know something on the actual fix? Skimming (but
only superficial) in the git repository I have not found something
obvious, but possible I only missed it.

Regards,
Salvatore

Message #38 received at 919529@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 919529@bugs.debian.org

Subject: Re: Bug#919529: CVE-2019-6256

Date: Sun, 20 Jan 2019 15:22:31 +0100

[Message part 1 (text/plain, inline)]

On 2019-01-19 22:36:05, Salvatore Bonaccorso wrote:
> Hey!
> 
> On Thu, Jan 17, 2019 at 12:00:13AM +0100, Sebastian Ramacher wrote:
> > Control: found -1 2016.11.28-1
> > 
> > On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> > > Source: liblivemedia
> > > Severity: grave
> > > Tags: security
> > > 
> > > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> > > 
> > > Cheers,
> > >         Moritz
> > 
> > Not sure if I'm missing something, but the PoC does not seem to work on
> > buster/sid. On stretch I get segfaults, but only if I abort the PoC. So marking
> > as found in stable and closing for sid.
> 
> Not having a poc triggering does not necessarly mean the issue needs
> to be fixed. Do we know something on the actual fix? Skimming (but
> only superficial) in the git repository I have not found something
> obvious, but possible I only missed it.

http://lists.live555.com/pipermail/live-devel/2018-November/021099.html
explicitely mentions that the issue was fixed in 2018.11.26.

Cheers
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #43 received at 919529@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Sebastian Ramacher <sramacher@debian.org>

Cc: 919529@bugs.debian.org

Subject: Re: Bug#919529: CVE-2019-6256

Date: Mon, 21 Jan 2019 17:30:41 +0100

Hi,

On Sun, Jan 20, 2019 at 03:22:31PM +0100, Sebastian Ramacher wrote:
> On 2019-01-19 22:36:05, Salvatore Bonaccorso wrote:
> > Hey!
> > 
> > On Thu, Jan 17, 2019 at 12:00:13AM +0100, Sebastian Ramacher wrote:
> > > Control: found -1 2016.11.28-1
> > > 
> > > On 2019-01-16 23:19:45, Moritz Muehlenhoff wrote:
> > > > Source: liblivemedia
> > > > Severity: grave
> > > > Tags: security
> > > > 
> > > > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6256
> > > > 
> > > > Cheers,
> > > >         Moritz
> > > 
> > > Not sure if I'm missing something, but the PoC does not seem to work on
> > > buster/sid. On stretch I get segfaults, but only if I abort the PoC. So marking
> > > as found in stable and closing for sid.
> > 
> > Not having a poc triggering does not necessarly mean the issue needs
> > to be fixed. Do we know something on the actual fix? Skimming (but
> > only superficial) in the git repository I have not found something
> > obvious, but possible I only missed it.
> 
> http://lists.live555.com/pipermail/live-devel/2018-November/021099.html
> explicitely mentions that the issue was fixed in 2018.11.26.

perfect, thank you!

Salvatore

Send a report that this bug log contains spam.