Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b0161609 by Salvatore Bonaccorso at 2026-10-02T06:35:20+02:00
Update status for liblivemedia
liblivemedia got re-introduced in unstable again, so switch the removed
state as a first step to unfixed. The current potential open CVEs need
to rechecked if they got fixed with the fist untable upload
2026.09.23-dfsg-1.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -31492,7 +31492,7 @@ CVE-2026-49363 (An unauthenticated remote attacker
connecting with the CORE prot
CVE-2026-49362 (An unauthenticated remote attacker can create arbitrary
durable queues ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-38998 (A use-after-free in the SocketDescriptor::tcpReadHandler1
function (li ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-36433 (An issue in Actions Semiconductor Co. Ltd Tool- Media Player
Utilities ...)
NOT-FOR-US: Actions Semiconductor Co. Ltd Tool- Media Player Utilities
CVE-2026-19840 (The Notiqoo WordPress plugin before 1.4.14 does not have
capability c ...)
@@ -141111,7 +141111,7 @@ CVE-2026-42096 (Sparx Pro Cloud Server is vulnerable
to Broken Access Control wi
CVE-2026-41919 (Improper Neutralization of Special Elements used in an LDAP
Query ('LD ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-41470 (LIVE555 before 2026.04.22 contains an authorization bypass
vulnerabili ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-3985 (The Creative Mail \u2013 Easier WordPress & WooCommerce Email
Marketin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-39309 (Trilium Notes is a cross-platform, hierarchical note taking
applicatio ...)
@@ -203667,7 +203667,7 @@ CVE-2026-22977 (In the Linux kernel, the following
vulnerability has been resolv
- linux 6.18.8-1
NOTE:
https://git.kernel.org/linus/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 (6.19-rc5)
CVE-2026-1200 (A flaw was found in the rgaufman/live555 fork of live555. A
remote att ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2026-1190 (A flaw was found in Keycloak's SAML brokering functionality.
When Keyc ...)
- keycloak <itp> (bug #1088287)
CVE-2026-0603 (A flaw was found in Hibernate. A remote attacker with low
privileges c ...)
@@ -227052,15 +227052,15 @@ CVE-2025-65794
CVE-2025-65793
REJECTED
CVE-2025-65408 (A NULL pointer dereference in the
ADTSAudioFileServerMediaSubsession:: ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65407 (A use-after-free in the MPEG1or2Demux::newElementaryStream()
function ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65406 (A heap overflow in the
MatroskaFile::createRTPSinkForTrackNumber() fun ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65405 (A use-after-free in the
ADTSAudioFileSource::samplingFrequency() funct ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65404 (A buffer overflow in the getSideInfo2() function of Live555
Streaming ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
CVE-2025-65403 (A buffer overflow in the g_cfg.MaxUsers component of LightFTP
v2.0 all ...)
NOT-FOR-US: LightFTP
CVE-2025-64775 (Denial of Service vulnerability in Apache Struts, file leak in
multipa ...)
@@ -436245,7 +436245,7 @@ CVE-2023-40362 (An issue was discovered in
CentralSquare Click2Gov Building Perm
CVE-2023-40250 (Buffer Copy without Checking Size of Input ('Classic Buffer
Overflow') ...)
NOT-FOR-US: Hancom
CVE-2023-37117 (A heap-use-after-free vulnerability was found in live555
version 2023. ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2023-June/022331.html
CVE-2023-36842 (An Improper Check for Unusual or Exceptional Conditions
vulnerability ...)
@@ -601146,7 +601146,7 @@ CVE-2021-41398
CVE-2021-41397
RESERVED
CVE-2021-41396 (Live555 through 1.08 does not handle socket connections
properly. A hu ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
CVE-2021-41395 (Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers
to contro ...)
NOT-FOR-US: Teleport
@@ -606548,12 +606548,12 @@ CVE-2021-39285 (A XSS vulnerability exists in Versa
Director Release: 16.1R2 Bui
CVE-2021-39284
RESERVED
CVE-2021-39283 (liveMedia/FramedSource.cpp in Live555 through 1.08 allows an
assertion ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <ignored> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-August/021969.html
CVE-2021-39282 (Live555 through 1.08 has a memory leak in AC3AudioStreamParser
for AC3 ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <ignored> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-August/021970.html
@@ -608804,19 +608804,19 @@ CVE-2021-38384 (Serverless Offline 8.0.0 returns a
403 HTTP status code for a ro
CVE-2021-38383 (OwnTone (aka owntone-server) through 28.1 has a use-after-free
in net_ ...)
NOT-FOR-US: OwnTone
CVE-2021-38382 (Live555 through 1.08 does not handle Matroska and Ogg files
properly. ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-August/021959.html
NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.06]
CVE-2021-38381 (Live555 through 1.08 does not handle MPEG-1 or 2 files
properly. Sendi ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-August/021961.html
NOTE: http://www.live555.com/liveMedia/public/changelog.txt#[2021.08.09]
CVE-2021-38380 (Live555 through 1.08 mishandles huge requests for the same MP3
stream, ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <ignored> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-August/021954.html
@@ -633440,7 +633440,7 @@ CVE-2021-28901 (Multiple cross-site scripting (XSS)
vulnerabilities exist in SIT
CVE-2021-28900
RESERVED
CVE-2021-28899 (Vulnerability in the AC3AudioFileServerMediaSubsession,
ADTSAudioFileS ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <no-dsa> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2021-March/021891.html
@@ -677450,7 +677450,7 @@ CVE-2020-24029 (Because of unauthenticated password
changes in ForLogic Qualiex
CVE-2020-24028 (ForLogic Qualiex v1 and v3 allows any authenticated customer
to achiev ...)
NOT-FOR-US: ForLogic Qualiex
CVE-2020-24027 (In Live Networks, Inc., liblivemedia version 20200625, there
is a pote ...)
- - liblivemedia <removed>
+ - liblivemedia <unfixed>
[buster] - liblivemedia <no-dsa> (Minor issue)
[stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE:
http://lists.live555.com/pipermail/live-devel/2020-July/021662.html
@@ -774106,7 +774106,7 @@ CVE-2019-7733 (In Live555 0.95, there is a buffer
overflow via a large integer i
NOTE: https://github.com/rgaufman/live555/issues/21
NOTE: fixed in 2019.05.12:
http://www.live555.com/liveMedia/public/changelog.txt
CVE-2019-7732 (In Live555 0.95, a setup packet can cause a memory leak leading
to DoS ...)
- - liblivemedia <removed> (unimportant)
+ - liblivemedia <unfixed> (unimportant)
[stretch] - liblivemedia <no-dsa> (Minor issue)
[jessie] - liblivemedia <no-dsa> (Minor issue, unlikely to be exploited
in practice)
NOTE: https://github.com/rgaufman/live555/issues/20
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b016160974e6b2c12ae50e64ff1065bcf8f4b3d3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b016160974e6b2c12ae50e64ff1065bcf8f4b3d3
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
