Description
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Live Networks LIVE555 Media Server
Version 0.92affected
References
- https://www.debian.org/security/2018/dsa-4343 ↗
- http://lists.live555.com/pipermail/live-devel/2018-October/021071.html ↗
- https://lists.debian.org/debian-lts-announce/2018/11/msg00020.html ↗
- https://security.gentoo.org/glsa/202005-06 ↗
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684 ↗