CVE-2019-7314
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP...
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
CVE-2019-7314- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
CVE-2019-7314- Updated
- 2026-11-02
EUVDEUVD-2019-16857 No score
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
EUVD-2019-16857- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mgg6-45mj-x85q
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP...
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
GHSA-mgg6-45mj-x85q- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7314
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
DEBIAN-CVE-2019-7314- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7314
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
- Record
UBUNTU-CVE-2019-7314- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2019-0121 No score
Updated live, mplayer, vlc packages fix security vulnerability
The updated live, mplayer, vlc packages fix security vulnerabilities:
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. (CVE-2019-7314)
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. (CVE-2019-9215)
Mplayer and VLC has been rebuilt against new live packages.
Also, VLC has been updated to version 3.0.6.
- Record
MGASA-2019-0121- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1797-1 No score
Security update for live555
This update for live555 fixes the following issues:
-
CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)
-
CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)
-
Update to version 2019.06.28,
-
Convert to dynamic libraries (boo#1121995):
- Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
- Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
- Split out shared library packages according the SLPP.
-
Use FAT LTO objects in order to provide proper static library.
- Record
openSUSE-SU-2019:1797-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1880-1 No score
Security update for live555
This update for live555 fixes the following issues:
-
CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)
-
CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)
-
Update to version 2019.06.28,
-
Convert to dynamic libraries (boo#1121995):
- Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
- Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
- Split out shared library packages according the SLPP.
-
Use FAT LTO objects in order to provide proper static library.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2019:1880-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0944-1 No score
Security update for live555
This update for live555 fixes the following issues:
-
CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)
-
CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)
-
Update to version 2019.06.28,
-
Convert to dynamic libraries (boo#1121995):
- Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
- Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
- Split out shared library packages according the SLPP.
-
Use FAT LTO objects in order to provide proper static library.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0944-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score
libBasicUsageEnvironment1-2021.08.23-1.2 on GA media
These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11023-1- Updated
- 2026-11-02
OSVUSN-4853-1 No score
liblivemedia vulnerabilities
It was discovered that liveMedia incorrectly handled certain network packets. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-4013)
It was discovered that liveMedia incorrectly handled certain network sessions. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-6256)
It was discovered that liveMedia incorrectly handled certain RTSP streamings. An attacker could possiby use this issue to cause a denial of service or other unspecified impact. (CVE-2019-7314)
It was discovered that liveMedia incorrectly handled certain requests. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9215)
- Record
USN-4853-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
liblivemediaDebian:14 |
before 2018.11.26-1.1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2 |
2018.11.26-1.1 |
liblivemediaDebian:8 |
before 2014.01.13-1+deb8u2, plus listed versions 2014.01.13-12014.01.13-1+deb8u1 |
2014.01.13-1+deb8u2 |
liblivemediaDebian:9 |
before 2016.11.28-1+deb9u2, plus listed versions 2016.11.28-12016.11.28-1+deb9u1 |
2016.11.28-1+deb9u2 |
liveMageia:6 |
before 2019.03.06-1.mga6 | 2019.03.06-1.mga6 |
mplayerMageia:6 |
before 1.3.0-14.mga6 | 1.3.0-14.mga6 |
vlcMageia:6 |
before 3.0.6-1.mga6 | 3.0.6-1.mga6 |
mplayerMageia:6 |
before 1.3.0-14.mga6.tainted | 1.3.0-14.mga6.tainted |
vlcMageia:6 |
before 3.0.6-1.mga6.tainted | 3.0.6-1.mga6.tainted |
liblivemediaUbuntu:Pro:16.04:LTS |
before 2016.02.09-1ubuntu0.1~esm1, plus listed versions 2014.01.13-12016.01.29-22016.02.09-1 |
2016.02.09-1ubuntu0.1~esm1 |
liblivemediaUbuntu:Pro:18.04:LTS |
before 2018.02.18-1ubuntu0.1~esm1, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-1 |
2018.02.18-1ubuntu0.1~esm1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
live555SUSE:Package Hub 15 |
before 2019.06.28-bp150.12.1 | 2019.06.28-bp150.12.1 |
live555openSUSE:Leap 15.0 |
before 2019.06.28-bp150.12.1 | 2019.06.28-bp150.12.1 |
live555openSUSE:Leap 15.1 |
before 2019.06.28-bp150.12.1 | 2019.06.28-bp150.12.1 |
live555SUSE:Package Hub 15 SP1 |
before 2019.06.28-bp151.3.3.1 | 2019.06.28-bp151.3.3.1 |
live555openSUSE:Leap 15.2 |
before 2019.06.28-lp152.3.3.1 | 2019.06.28-lp152.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7314 is a critical vulnerability (CVSS 9.8) in Debian Linux, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. Fixed in liblivemedia 2018.11.26-1.1.
References
lists.debian.org/debian-lts-announce/2019/02/msg00037.html
live555.com/liveMedia/public/changelog.txt
lists.live555.com/pipermail/live-devel/2019-February/021143.html
seclists.org/bugtraq/2019/Mar/22
debian.org/security/2019/dsa-4408
lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html
Show 32 moreShow less
security.gentoo.org/glsa/202005-06
nvd.nist.gov/vuln/detail/CVE-2019-7314
github.com/advisories/GHSA-mgg6-45mj-x85q
security-tracker.debian.org/tracker/CVE-2019-7314
advisories.mageia.org/MGASA-2019-0121.html
bugs.mageia.org/show_bug.cgi?id=24527
videolan.org/developers/vlc-branch/NEWS
ubuntu.com/security/CVE-2019-7314
cve.org/CVERecord?id=CVE-2019-7314
bugzilla.suse.com/1121995
suse.com/security/cve/CVE-2019-7314
Left out here: 37 versions. The JSON record has them.