liblivemedia: CVE-2019-7314: mishandling of RTSP stream termination causes use-after-free and crash

Debian Bug report logs - #924656
liblivemedia: CVE-2019-7314: mishandling of RTSP stream termination causes use-after-free and crash

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hugo Lefeuvre <hle@debian.org>

To: submit@bugs.debian.org

Subject: liblivemedia: CVE-2019-7314: mishandling of RTSP stream termination causes use-after-free and crash

Date: Fri, 15 Mar 2019 15:21:29 +0100

[Message part 1 (text/plain, inline)]

Source: liblivemedia
Version: 2018.11.26-1
Severity: normal
Tags: security upstream

Hi,

The following vulnerability was published for liblivemedia.

CVE-2019-7314[0]: 
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an
RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a
Use-After-Free error that causes the RTSP server to crash (Segmentation
fault) or possibly have unspecified other impact.

We might want to fix this in Buster, the patch is straightforward. I can
provide a debdiff if needed, already uploaded fixes for stretch and jessie.

regards,
Hugo

[0] https://security-tracker.debian.org/tracker/CVE-2019-7314

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

[signature.asc (application/pgp-signature, inline)]

Message #18 received at 924656-done@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Hugo Lefeuvre <hle@debian.org>, 924656-doe@bugs.debian.org

Subject: Re: Bug#924656: liblivemedia: CVE-2019-7314: mishandling of RTSP stream termination causes use-after-free and crash

Date: Fri, 15 Mar 2019 18:23:01 +0100

[Message part 1 (text/plain, inline)]

Version: 2019.02.03-1

Marking as fixed with the upload of 2019.02.03-1.

On 2019-03-15 15:21:29, Hugo Lefeuvre wrote:
> Source: liblivemedia
> Version: 2018.11.26-1
> Severity: normal
> Tags: security upstream
> 
> Hi,
> 
> The following vulnerability was published for liblivemedia.
> 
> CVE-2019-7314[0]: 
> liblivemedia in Live555 before 2019.02.03 mishandles the termination of an
> RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a
> Use-After-Free error that causes the RTSP server to crash (Segmentation
> fault) or possibly have unspecified other impact.
> 
> We might want to fix this in Buster, the patch is straightforward. I can
> provide a debdiff if needed, already uploaded fixes for stretch and jessie.
> 
> regards,
> Hugo
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-7314
> 
> -- 
>                 Hugo Lefeuvre (hle)    |    www.owl.eu.com
> RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
> ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C



-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 924656-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 924655-submitter@bugs.debian.org, 924656-submitter@bugs.debian.org

Subject: closing 924656, closing 924655

Date: Mon, 06 May 2019 21:15:18 +0200

close 924656 2018.11.26-1.1
close 924655 2018.11.26-1.1
thanks

Send a report that this bug log contains spam.