[Git][security-tracker-team/security-tracker][master] various liblivemedia issues fixed in re-upload

Moritz Muehlenhoff (@jmm) jmm at debian.org
Sun Oct 4 19:51:26 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
45ff492d by Moritz Muehlenhoff at 2026-10-04T20:50:30+02:00
various liblivemedia issues fixed in re-upload

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -33329,7 +33329,7 @@ CVE-2026-49363 (An unauthenticated remote attacker connecting with the CORE prot
 CVE-2026-49362 (An unauthenticated remote attacker can create arbitrary durable queues ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-38998 (A use-after-free in the SocketDescriptor::tcpReadHandler1 function (li ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 CVE-2026-36433 (An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities ...)
 	NOT-FOR-US: Actions Semiconductor Co. Ltd Tool- Media Player Utilities
 CVE-2026-19840 (The Notiqoo  WordPress plugin before 1.4.14 does not have capability c ...)
@@ -143005,7 +143005,7 @@ CVE-2026-42096 (Sparx Pro Cloud Server is vulnerable to Broken Access Control wi
 CVE-2026-41919 (Improper Neutralization of Special Elements used in an LDAP Query ('LD ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-41470 (LIVE555 before 2026.04.22 contains an authorization bypass vulnerabili ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 CVE-2026-3985 (The Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketin ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-39309 (Trilium Notes is a cross-platform, hierarchical note taking applicatio ...)
@@ -205562,7 +205562,7 @@ CVE-2026-22977 (In the Linux kernel, the following vulnerability has been resolv
 	- linux 6.18.8-1
 	NOTE: https://git.kernel.org/linus/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 (6.19-rc5)
 CVE-2026-1200 (A flaw was found in the rgaufman/live555 fork of live555. A remote att ...)
-	- liblivemedia <unfixed>
+	- liblivemedia <not-affected> (issue in fork of liblivemedia)
 CVE-2026-1190 (A flaw was found in Keycloak's SAML brokering functionality. When Keyc ...)
 	- keycloak <itp> (bug #1088287)
 CVE-2026-0603 (A flaw was found in Hibernate. A remote attacker with low privileges c ...)
@@ -608447,12 +608447,12 @@ CVE-2021-39285 (A XSS vulnerability exists in Versa Director Release: 16.1R2 Bui
 CVE-2021-39284
 	RESERVED
 CVE-2021-39283 (liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <ignored> (Minor issue)
 	[stretch] - liblivemedia <ignored> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021969.html
 CVE-2021-39282 (Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <ignored> (Minor issue)
 	[stretch] - liblivemedia <ignored> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021970.html
@@ -610703,19 +610703,19 @@ CVE-2021-38384 (Serverless Offline 8.0.0 returns a 403 HTTP status code for a ro
 CVE-2021-38383 (OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_ ...)
 	NOT-FOR-US: OwnTone
 CVE-2021-38382 (Live555 through 1.08 does not handle Matroska and Ogg files properly.  ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <ignored> (Minor issue)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021959.html
 	NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.06]
 CVE-2021-38381 (Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sendi ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <ignored> (Minor issue)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021961.html
 	NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.09]
 CVE-2021-38380 (Live555 through 1.08 mishandles huge requests for the same MP3 stream, ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <ignored> (Minor issue)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-August/021954.html
@@ -635339,7 +635339,7 @@ CVE-2021-28901 (Multiple cross-site scripting (XSS) vulnerabilities exist in SIT
 CVE-2021-28900
 	RESERVED
 CVE-2021-28899 (Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileS ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <no-dsa> (Minor issue)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2021-March/021891.html
@@ -679349,7 +679349,7 @@ CVE-2020-24029 (Because of unauthenticated password changes in ForLogic Qualiex
 CVE-2020-24028 (ForLogic Qualiex v1 and v3 allows any authenticated customer to achiev ...)
 	NOT-FOR-US: ForLogic Qualiex
 CVE-2020-24027 (In Live Networks, Inc., liblivemedia version 20200625, there is a pote ...)
-	- liblivemedia <unfixed>
+	- liblivemedia 2026.09.23-dfsg-1
 	[buster] - liblivemedia <no-dsa> (Minor issue)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	NOTE: http://lists.live555.com/pipermail/live-devel/2020-July/021662.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/45ff492d0b2a5c967cf9848327b82e23ddbdcc83

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/45ff492d0b2a5c967cf9848327b82e23ddbdcc83
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/1778bb57/attachment.htm>

More information about the debian-security-tracker-commits mailing list