VulnerabilityModified
CVE-2021-38382
Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
MEDIUM 6.5EPSS 1.19%
Does this matter?
Lower severity and a low EPSS score (1.19%). Track it; it rarely justifies an emergency change on its own.
Description
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.19% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- live555/live555
- Source
- cve@mitre.org
References
- http://lists.live555.com/pipermail/live-devel/2021-August/021959.htmlExploit, Mailing List, Vendor Advisory
- http://www.live555.com/liveMedia/public/changelog.txt#%5B2021.08.06%5D
- http://lists.live555.com/pipermail/live-devel/2021-August/021959.htmlExploit, Mailing List, Vendor Advisory
- http://www.live555.com/liveMedia/public/changelog.txt#%5B2021.08.06%5D
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.