CVE-2026-41470

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

These are all security issues fixed in the libBasicUsageEnvironment2-2026.04.22-1.1 package on the GA media of openSUSE Tumbleweed.

This update for live555 fixes the following issues:

Changes in live555:

• Update to version 2026.08.25:

  • Fixed a bug in "VorbisAudioRTPSource" that could have caused a malicious SDP description to crash a RTP client.

• update to 2026.08.14:

  • Fixed a bug that could cause a problem with subclassed variants of H.264 or H.265 RTP sinks.
  • Fixed old code in "GroupsockHelper.cpp" that was using hardcoded numeric error numbers
  • Fixed a memory leak that could occur when parsing a SDP description that contains two or more
  • When adding protection against the use of 'stolen' RTSP session ids we forgot to do so for every "SETUP" command. This release fixes that.
  • Fixed a typo in "RTSPCommon.cpp": "smtpe" -> "smpte".
  • Updated the RTSP server implementation to return a "Unsupported Transport" error if a "SETUP" request does not include a "Transport:" header.
  • Added "-std=c++20" to the "CPLUSPLUS_FLAGS" line in each "config.*" file, so that "std::atomic_flag::test" will compile with compilers that support
  • Made the parsing of MP3 audio files more robust to protect against malformed MP3 data.
  • Minor change to "testProgs/testRTSPClient.cpp" to make compiling on Mac OS X happier.

• Update to version 2026.06.01:

  • Updated the "RTSPServer" implementation of the "SETUP" command to make it more robust if subclassed code reimplements "lookupServerMediaSession()" as an asynchronous operation.

• update to 2026.05.30:

  • Updated the "RTSPServer" implementation some more to make it more robust if subclassed code reimplements "lookpServerMediaSession()" as an asynchronous operation.
  • Added an (integer) index to identify each server's 'client connection', and changed the "fClientConnections" table to be indexed by this id.
  • In the "RTSPServer" implementation, removed the "fOurClientConnection" member variable. This had been left over from when the RTSP "SETUP" command had been implemented as a single, synchronous function. Now that "SETUP" is implemented using multiple functions, possibly asynchronously (depending upon how "lookpServerMediaSession()" is implemented), this member variable was potentially dangerous if more than one "SETUP" is performed concurrently on the same client connection, or on separate client connections.

• update to 2026.05.28:

  • fix use-after-free memory corruption introduced in fix for CVE-2026-41470

• Update to version 2026.04.22 (CVE-2026-41470, boo#1265856):

  • Added extra checking to the handling of the RTSP server's "PLAY", "PAUSE", "TEARDOWN", and "SET_PARAMETER" commands, to ensure that, if the session is authenticated, then a proper authentication check is done before these commands are handled. This protects against the use of a 'stolen' RTSP session id to send these commands. (Note, however, that if the session is not authenticated (i.e., no username,password is needed), then no such protection is possible.)

• Changes from version 2026-04-01:

  • Updated the way that the RTSP server generates successive RTSP 'session ids' to make it less likely that an attacker could guess a session id.
  • Updated the RTSP server implementation to make it possible for a client to request both interleaved (i.e., RTP/RTCP-over-TCP) and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within the same session.

• Update to version 2026.03.23 (boo#1279932):

  • CVE-2026-38998: Fixed a bug in the RTSP server code that caused it to improperly handle non-interleaved "SETUP"s that were sent for a session where interleaving (i.e., RTP/RTCP-over-TCP) had already been "SETUP". (This could cause a 'use-after-free' error.
  • For changes between 2024.08.01 to today, please refer to https://download.live555.com/changelog.txt

• update to 2024-08-01:

  • Updated "ServerMediaSession::generateSDPDescription()" to treat…