Live555 — known CVE vulnerabilities

Every CVE whose affected-product data names Live555, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2023-37117 — CVSS 9.8 (critical): A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
• CVE-2021-39282 — CVSS 7.5 (high): Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
• CVE-2021-38380 — CVSS 7.5 (high): Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker…
• CVE-2021-41396 — CVSS 7.5 (high): Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the…
• CVE-2021-38382 — CVSS 6.5 (medium): Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes…
• CVE-2021-38381 — CVSS 6.5 (medium): Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a…
• CVE-2021-39283 — CVSS 5.5 (medium): liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.