Every CVE Search/ Get API key

CVE-2019-9215

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the...

9.8 CriticalFix available

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.17%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
CVE-2019-9215
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
CVE-2019-9215
Updated
2026-11-02
EUVDEUVD-2019-18590 No score

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
EUVD-2019-18590
Updated
2026-11-03
GitHub AdvisoriesGHSA-m95x-799j-2j8h 9.8

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the...

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
GHSA-m95x-799j-2j8h
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-9215 9.8

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
DEBIAN-CVE-2019-9215
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-9215 9.8

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

Record
UBUNTU-CVE-2019-9215
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVMGASA-2019-0121 No score

Updated live, mplayer, vlc packages fix security vulnerability

The updated live, mplayer, vlc packages fix security vulnerabilities:

liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. (CVE-2019-7314)

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. (CVE-2019-9215)

Mplayer and VLC has been rebuilt against new live packages.

Also, VLC has been updated to version 3.0.6.

Record
MGASA-2019-0121
Updated
2026-11-02
OSVopenSUSE-SU-2019:1797-1 No score

Security update for live555

This update for live555 fixes the following issues:

  • CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)

  • CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)

  • Update to version 2019.06.28,

  • Convert to dynamic libraries (boo#1121995):

    • Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
    • Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
    • Split out shared library packages according the SLPP.

  • Use FAT LTO objects in order to provide proper static library.

Record
openSUSE-SU-2019:1797-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1880-1 No score

Security update for live555

This update for live555 fixes the following issues:

  • CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)

  • CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)

  • Update to version 2019.06.28,

  • Convert to dynamic libraries (boo#1121995):

    • Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
    • Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
    • Split out shared library packages according the SLPP.

  • Use FAT LTO objects in order to provide proper static library.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2019:1880-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0944-1 No score

Security update for live555

This update for live555 fixes the following issues:

  • CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341)

  • CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159)

  • Update to version 2019.06.28,

  • Convert to dynamic libraries (boo#1121995):

    • Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one.
    • Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before.
    • Split out shared library packages according the SLPP.

  • Use FAT LTO objects in order to provide proper static library.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:0944-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score

libBasicUsageEnvironment1-2021.08.23-1.2 on GA media

These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11023-1
Updated
2026-11-02
OSVUSN-4853-1 No score

liblivemedia vulnerabilities

It was discovered that liveMedia incorrectly handled certain network packets. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-4013)

It was discovered that liveMedia incorrectly handled certain network sessions. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-6256)

It was discovered that liveMedia incorrectly handled certain RTSP streamings. An attacker could possiby use this issue to cause a denial of service or other unspecified impact. (CVE-2019-7314)

It was discovered that liveMedia incorrectly handled certain requests. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9215)

Record
USN-4853-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
liblivemedia
Debian:14
 before 2018.11.26-1.1, plus listed versions
2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1
Show 45 moreShow less
2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2
2018.11.26-1.1
liblivemedia
Debian:8
 before 2014.01.13-1+deb8u3, plus listed versions
2014.01.13-12014.01.13-1+deb8u12014.01.13-1+deb8u2
2014.01.13-1+deb8u3
liblivemedia
Debian:9
 before 2016.11.28-1+deb9u2, plus listed versions
2016.11.28-12016.11.28-1+deb9u1
2016.11.28-1+deb9u2
live
Mageia:6
 before 2019.03.06-1.mga6
2019.03.06-1.mga6
mplayer
Mageia:6
 before 1.3.0-14.mga6
1.3.0-14.mga6
vlc
Mageia:6
 before 3.0.6-1.mga6
3.0.6-1.mga6
mplayer
Mageia:6
 before 1.3.0-14.mga6.tainted
1.3.0-14.mga6.tainted
vlc
Mageia:6
 before 3.0.6-1.mga6.tainted
3.0.6-1.mga6.tainted
liblivemedia
Ubuntu:Pro:16.04:LTS
 before 2016.02.09-1ubuntu0.1~esm1, plus listed versions
2014.01.13-12016.01.29-22016.02.09-1
2016.02.09-1ubuntu0.1~esm1
liblivemedia
Ubuntu:Pro:18.04:LTS
 before 2018.02.18-1ubuntu0.1~esm1, plus listed versions
2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-1
2018.02.18-1ubuntu0.1~esm1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
live555
SUSE:Package Hub 15
 before 2019.06.28-bp150.12.1
2019.06.28-bp150.12.1
live555
openSUSE:Leap 15.0
 before 2019.06.28-bp150.12.1
2019.06.28-bp150.12.1
live555
openSUSE:Leap 15.1
 before 2019.06.28-bp150.12.1
2019.06.28-bp150.12.1
live555
SUSE:Package Hub 15 SP1
 before 2019.06.28-bp151.3.3.1
2019.06.28-bp151.3.3.1
live555
openSUSE:Leap 15.2
 before 2019.06.28-lp152.3.3.1
2019.06.28-lp152.3.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9215 is a critical vulnerability (CVSS 9.8) in Debian Linux, published February 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. Fixed in liblivemedia 2018.11.26-1.1.

References

Show 31 moreShow less
This page doesn't list everything

Left out here: 37 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open