CVE-2019-15232
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer:...
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
CVE-2019-15232- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
CVE-2019-15232- Updated
- 2026-11-02
EUVDEUVD-2019-6244 No score
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
EUVD-2019-6244- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m42g-4p87-qcrh
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer:...
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
GHSA-m42g-4p87-qcrh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15232
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
DEBIAN-CVE-2019-15232- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15232
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Record
UBUNTU-CVE-2019-15232- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2021-0313 No score
Updated live packages fix security vulnerabilities
Updated live packages fix security vulnerabilities:
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors (CVE-2019-15232).
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16 (CVE-2021-28899).
The mplayer package has been rebuilt against the updated live package.
- Record
MGASA-2021-0313- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0915-1 No score
Security update for live555
This update for live555 fixes the following issues:
Update to 2021.05.22:
- Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt
- Record
openSUSE-SU-2021:0915-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0937-1 No score
Security update for live555
This update for live555 fixes the following issues:
Update to 2021.05.22:
- Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0937-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score
libBasicUsageEnvironment1-2021.08.23-1.2 on GA media
These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
liblivemediaDebian:14 |
before 2019.10.11-2, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2 |
2019.10.11-2 |
liveMageia:7 |
before 2021.06.25-1.mga7 | 2021.06.25-1.mga7 |
mplayerMageia:7 |
before 1.4-1.1.mga7 | 1.4-1.1.mga7 |
mplayerMageia:7 |
before 1.4-1.1.mga7.tainted | 1.4-1.1.mga7.tainted |
liveMageia:8 |
before 2021.06.25-1.mga8 | 2021.06.25-1.mga8 |
mplayerMageia:8 |
before 1.4-9.3.mga8 | 1.4-9.3.mga8 |
mplayerMageia:8 |
before 1.4-9.3.mga8.tainted | 1.4-9.3.mga8.tainted |
liblivemediaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:20.04:LTS |
All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1 |
None known |
liblivemediaUbuntu:26.10 |
All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4 |
None known |
live555openSUSE:Leap 15.2 |
before 2021.05.22-lp152.3.6.1 | 2021.05.22-lp152.3.6.1 |
live555SUSE:Package Hub 15 SP2 |
before 2021.05.22-bp152.4.4.1 | 2021.05.22-bp152.4.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15232 is a critical vulnerability (CVSS 9.8) in Live555 Streaming Media, published August 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.73%, the 77th percentile. Fixed in liblivemedia 2019.10.11-2.
References
live555.com/liveMedia/public/changelog.txt
security.gentoo.org/glsa/202005-06
nvd.nist.gov/vuln/detail/CVE-2019-15232
github.com/advisories/GHSA-m42g-4p87-qcrh
security-tracker.debian.org/tracker/CVE-2019-15232
advisories.mageia.org/MGASA-2021-0313.html
Show 19 moreShow less
bugs.mageia.org/show_bug.cgi?id=29175
lists.live555.com/pipermail/live-devel/2021-March/021891.html
lists.opensuse.org/archives/list/[email protected]/thread/Y7ZOGH7UAC6Q7OJHR62KOMWS64YF4G73
ubuntu.com/security/CVE-2019-15232
cve.org/CVERecord?id=CVE-2019-15232
bugzilla.suse.com/1146283
suse.com/security/cve/CVE-2019-15232
Left out here: 49 versions. The JSON record has them.