CVE-2021-38382
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP...
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
CVE-2021-38382- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
CVE-2021-38382- Updated
- 2026-11-02
EUVDEUVD-2021-24835 No score
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
EUVD-2021-24835- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3v3m-cp4r-m942 No score
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP...
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
GHSA-3v3m-cp4r-m942- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-38382
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
ALPINE-CVE-2021-38382- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2021-38382
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
DEBIAN-CVE-2021-38382- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38382
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- Record
UBUNTU-CVE-2021-38382- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score
libBasicUsageEnvironment1-2021.08.23-1.2 on GA media
These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
live-mediaAlpine:v3.16 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.17 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.18 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.19 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.20 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.21 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.22 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.23 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.24 |
before 2022.02.07-r0 | 2022.02.07-r0 |
liblivemediaDebian:14 |
before 2026.09.23-dfsg-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2 |
2026.09.23-dfsg-1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
liblivemediaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:20.04:LTS |
All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1 |
None known |
liblivemediaUbuntu:26.10 |
All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38382 is a medium vulnerability (CVSS 6.5) in Live555, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in live-media 2022.02.07-r0.
References
lists.live555.com/pipermail/live-devel/2021-August/021959.html
live555.com/liveMedia/public/changelog.txt
nvd.nist.gov/vuln/detail/CVE-2021-38382
github.com/advisories/GHSA-3v3m-cp4r-m942
security.alpinelinux.org/vuln/CVE-2021-38382
security-tracker.debian.org/tracker/CVE-2021-38382
Show 13 moreShow less
ubuntu.com/security/CVE-2021-38382
cve.org/CVERecord?id=CVE-2021-38382
suse.com/security/cve/CVE-2018-4013
Left out here: 52 versions. The JSON record has them.