CVE-2021-28899
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and...
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
CVE-2021-28899- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
CVE-2021-28899- Updated
- 2026-11-02
EUVDEUVD-2021-15552 No score
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
EUVD-2021-15552- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5q6q-cvmx-r6c6 No score
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and...
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
GHSA-5q6q-cvmx-r6c6- Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-28899
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
DEBIAN-CVE-2021-28899- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-28899
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
- Record
UBUNTU-CVE-2021-28899- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2021-0313 No score
Updated live packages fix security vulnerabilities
Updated live packages fix security vulnerabilities:
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors (CVE-2019-15232).
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16 (CVE-2021-28899).
The mplayer package has been rebuilt against the updated live package.
- Record
MGASA-2021-0313- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0915-1 No score
Security update for live555
This update for live555 fixes the following issues:
Update to 2021.05.22:
- Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt
- Record
openSUSE-SU-2021:0915-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0937-1 No score
Security update for live555
This update for live555 fixes the following issues:
Update to 2021.05.22:
- Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0937-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score
libBasicUsageEnvironment1-2021.08.23-1.2 on GA media
These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
liblivemediaDebian:14 |
before 2026.09.23-dfsg-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2 |
2026.09.23-dfsg-1 |
liveMageia:7 From an advisory covering 2 CVEs |
before 2021.06.25-1.mga7 | 2021.06.25-1.mga7 |
mplayerMageia:7 From an advisory covering 2 CVEs |
before 1.4-1.1.mga7 | 1.4-1.1.mga7 |
mplayerMageia:7 From an advisory covering 2 CVEs |
before 1.4-1.1.mga7.tainted | 1.4-1.1.mga7.tainted |
liveMageia:8 From an advisory covering 2 CVEs |
before 2021.06.25-1.mga8 | 2021.06.25-1.mga8 |
mplayerMageia:8 From an advisory covering 2 CVEs |
before 1.4-9.3.mga8 | 1.4-9.3.mga8 |
mplayerMageia:8 From an advisory covering 2 CVEs |
before 1.4-9.3.mga8.tainted | 1.4-9.3.mga8.tainted |
liblivemediaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:20.04:LTS |
All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1 |
None known |
liblivemediaUbuntu:26.10 |
All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4 |
None known |
live555openSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 2021.05.22-lp152.3.6.1 | 2021.05.22-lp152.3.6.1 |
live555SUSE:Package Hub 15 SP2 From an advisory covering 2 CVEs |
before 2021.05.22-bp152.4.4.1 | 2021.05.22-bp152.4.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28899 is a high vulnerability (CVSS 7.5) in Live555 Streaming Media, published April 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in liblivemedia 2026.09.23-dfsg-1.
References
lists.live555.com/pipermail/live-devel/2021-March/021891.html
nvd.nist.gov/vuln/detail/CVE-2021-28899
github.com/advisories/GHSA-5q6q-cvmx-r6c6
security-tracker.debian.org/tracker/CVE-2021-28899
advisories.mageia.org/MGASA-2021-0313.html
bugs.mageia.org/show_bug.cgi?id=29175
Show 18 moreShow less
live555.com/liveMedia/public/changelog.txt
lists.opensuse.org/archives/list/[email protected]/thread/Y7ZOGH7UAC6Q7OJHR62KOMWS64YF4G73
ubuntu.com/security/CVE-2021-28899
cve.org/CVERecord?id=CVE-2021-28899
bugzilla.suse.com/1146283
suse.com/security/cve/CVE-2019-15232
Left out here: 52 versions. The JSON record has them.