[Git][security-tracker-team/security-tracker][master] Update status for liblivemedia
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 05:36:35 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
b0161609 by Salvatore Bonaccorso at 2026-10-02T06:35:20+02:00
Update status for liblivemedia
liblivemedia got re-introduced in unstable again, so switch the removed
state as a first step to unfixed. The current potential open CVEs need
to rechecked if they got fixed with the fist untable upload
2026.09.23-dfsg-1.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -31492,7 +31492,7 @@ CVE-2026-49363 (An unauthenticated remote attacker connecting with the CORE prot
CVE-2026-49362 (An unauthenticated remote attacker can create arbitrary durable queues ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-38998 (A use-after-free in the SocketDescriptor::tcpReadHandler1 function (li ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-36433 (An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities ...)
NOT-FOR-US: Actions Semiconductor Co. Ltd Tool- Media Player Utilities
CVE-2026-19840 (The Notiqoo WordPress plugin before 1.4.14 does not have capability c ...)
@@ -141111,7 +141111,7 @@ CVE-2026-42096 (Sparx Pro Cloud Server is vulnerable to Broken Access Control wi
CVE-2026-41919 (Improper Neutralization of Special Elements used in an LDAP Query ('LD ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-41470 (LIVE555 before 2026.04.22 contains an authorization bypass vulnerabili ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-3985 (The Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-39309 (Trilium Notes is a cross-platform, hierarchical note taking applicatio ...)
@@ -203667,7 +203667,7 @@ CVE-2026-22977 (In the Linux kernel, the following vulnerability has been resolv
- linux 6.18.8-1
NOTE: https://git.kernel.org/linus/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 (6.19-rc5)
CVE-2026-1200 (A flaw was found in the rgaufman/live555 fork of live555. A remote att ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-1190 (A flaw was found in Keycloak's SAML brokering functionality. When Keyc ...)
- keycloak <itp> (bug #1088287)
CVE-2026-0603 (A flaw was found in Hibernate. A remote attacker with low privileges c ...)
@@ -227052,15 +227052,15 @@ CVE-2025-65794
CVE-2025-65793
REJECTED
CVE-2025-65408 (A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession:: ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65407 (A use-after-free in the MPEG1or2Demux::newElementaryStream() function ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65406 (A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() fun ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65405 (A use-after-free in the ADTSAudioFileSource::samplingFrequency() funct ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65404 (A buffer overflow in the getSideInfo2() function of Live555 Streaming ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65403 (A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 all ...)
NOT-FOR-US: LightFTP
CVE-2025-64775 (Denial of Service vulnerability in Apache Struts, file leak in multipa ...)
@@ -436245,7 +436245,7 @@ CVE-2023-40362 (An issue was discovered in CentralSquare Click2Gov Building Perm
CVE-2023-40250 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') ...)
NOT-FOR-US: Hancom
CVE-2023-37117 (A heap-use-after-free vulnerability was found in live555 version 2023. ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2023-June/022331.html
CVE-2023-36842 (An Improper Check for Unusual or Exceptional Conditions vulnerability ...)
@@ -601146,7 +601146,7 @@ CVE-2021-41398
CVE-2021-41397
RESERVED
CVE-2021-41396 (Live555 through 1.08 does not handle socket connections properly. A hu ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
CVE-2021-41395 (Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to contro ...)
NOT-FOR-US: Teleport
@@ -606548,12 +606548,12 @@ CVE-2021-39285 (A XSS vulnerability exists in Versa Director Release: 16.1R2 Bui
CVE-2021-39284
RESERVED
CVE-2021-39283 (liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <ignored> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021969.html
CVE-2021-39282 (Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <ignored> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021970.html
@@ -608804,19 +608804,19 @@ CVE-2021-38384 (Serverless Offline 8.0.0 returns a 403 HTTP status code for a ro
CVE-2021-38383 (OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_ ...)
NOT-FOR-US: OwnTone
CVE-2021-38382 (Live555 through 1.08 does not handle Matroska and Ogg files properly. ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021959.html
NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.06]
CVE-2021-38381 (Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sendi ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021961.html
NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.09]
CVE-2021-38380 (Live555 through 1.08 mishandles huge requests for the same MP3 stream, ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021954.html
@@ -633440,7 +633440,7 @@ CVE-2021-28901 (Multiple cross-site scripting (XSS) vulnerabilities exist in SIT
CVE-2021-28900
RESERVED
CVE-2021-28899 (Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileS ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <no-dsa> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2021-March/021891.html
@@ -677450,7 +677450,7 @@ CVE-2020-24029 (Because of unauthenticated password changes in ForLogic Qualiex
CVE-2020-24028 (ForLogic Qualiex v1 and v3 allows any authenticated customer to achiev ...)
NOT-FOR-US: ForLogic Qualiex
CVE-2020-24027 (In Live Networks, Inc., liblivemedia version 20200625, there is a pote ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <no-dsa> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: http://lists.live555.com/pipermail/live-devel/2020-July/021662.html
@@ -774106,7 +774106,7 @@ CVE-2019-7733 (In Live555 0.95, there is a buffer overflow via a large integer i
NOTE: https://github.com/rgaufman/live555/issues/21
NOTE: fixed in 2019.05.12: http://www.live555.com/liveMedia/public/changelog.txt
CVE-2019-7732 (In Live555 0.95, a setup packet can cause a memory leak leading to DoS ...)
- - liblivemedia <removed> (unimportant)
+ - liblivemedia <unfixed> (unimportant)
[stretch] - liblivemedia <no-dsa> (Minor issue)
[jessie] - liblivemedia <no-dsa> (Minor issue, unlikely to be exploited in practice)
NOTE: https://github.com/rgaufman/live555/issues/20
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b016160974e6b2c12ae50e64ff1065bcf8f4b3d3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b016160974e6b2c12ae50e64ff1065bcf8f4b3d3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/a8878864/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list