crítica
CVE-2019-6256
A Denial of Service issue was discovered in the LIVE555 Streaming Medi ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 14 | liblivemedia | 2018.11.26-1 |
| debian 8 | liblivemedia | 2014.01.13-1+deb8u2 |
| debian 9 | liblivemedia | 2016.11.28-1+deb9u2 |
| ubuntu 16.04-ESM | liblivemedia | 2016.02.09-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | liblivemedia | 2018.02.18-1ubuntu0.1~esm1 |
| ubuntu 19.04 | liblivemedia | 2018.11.26-1 |
| ubuntu 19.10 | liblivemedia | 2018.11.26-1 |
| ubuntu 20.04 | liblivemedia | 2018.11.26-1 |
| ubuntu 20.04-ESM | liblivemedia | 2018.11.26-1 |
| ubuntu 20.10 | liblivemedia | 2018.11.26-1 |
Referencias
- https://github.com/rgaufman/live555/issues/19
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://ubuntu.com/security/notices/USN-4853-1
- https://www.cve.org/CVERecord?id=CVE-2019-6256
- https://www.debian.org/security/2019/dsa-4408