[Live-devel] two security fixes for live555?

[Gianfranco Costamagna]

Hello Ross!

>But there’s nothing here to ‘fix’, because that CVE is completely wrong. Furthermore, it was >not filed against our code, but against someone else’s GitHub repository (which has already >heavily modified our code).

I'll ask security team to mark is as invalid then, let's see!

>It would be best if you not modify our code at all; see http://live555.com/liveMedia/>faq.html#modifying-and-extending

I already sent the patches we carry downstream, please let me know if you can integrate or not
(added them again to this email!)

>(As an aside, I’d personally prefer that Linux distributions *not* include copies of the “LIVE555 >Streaming Media” code. But if they do, then they should include the latest version (currently, >2026.10.29); see http://live555.com/liveMedia/faq.html#latest-version . Note that, to my >knowledge, the code is not used at all in any Linux *kernel*.)

We use it to enable RTSP support in vlc, or do you mean to not ship any binary and just the library?

I'm currently shipping those binaries, but I can remove them if you don't want them to be included (they are in an -utils package, not in the main library binary)

-rwxr-xr-x root/root 14584 2026-10-31 09:38 ./usr/bin/MPEG2TransportStreamIndexer
-rwxr-xr-x root/root 27344 2026-10-31 09:38 ./usr/bin/live555HLSProxy
-rwxr-xr-x root/root 27312 2026-10-31 09:38 ./usr/bin/live555MediaServer
-rwxr-xr-x root/root 14736 2026-10-31 09:38 ./usr/bin/live555ProxyServer
-rwxr-xr-x root/root 18704 2026-10-31 09:38 ./usr/bin/mikeyParse
-rwxr-xr-x root/root 43888 2026-10-31 09:38 ./usr/bin/openRTSP
-rwxr-xr-x root/root 52128 2026-10-31 09:38 ./usr/bin/playSIP
-rwxr-xr-x root/root 14664 2026-10-31 09:38 ./usr/bin/registerRTSPStream
-rwxr-xr-x root/root 14696 2026-10-31 09:38 ./usr/bin/sapWatch
-rwxr-xr-x root/root 14776 2026-10-31 09:38 ./usr/bin/testAMRAudioStreamer
-rwxr-xr-x root/root 18880 2026-10-31 09:38 ./usr/bin/testDVVideoStreamer
-rwxr-xr-x root/root 18880 2026-10-31 09:38 ./usr/bin/testH264VideoStreamer
-rwxr-xr-x root/root 14600 2026-10-31 09:38 ./usr/bin/testH264VideoToHLSSegments
-rwxr-xr-x root/root 14576 2026-10-31 09:38 ./usr/bin/testH264VideoToTransportStream
-rwxr-xr-x root/root 18880 2026-10-31 09:38 ./usr/bin/testH265VideoStreamer
-rwxr-xr-x root/root 14576 2026-10-31 09:38 ./usr/bin/testH265VideoToTransportStream
-rwxr-xr-x root/root 14616 2026-10-31 09:38 ./usr/bin/testMKVSplitter
-rwxr-xr-x root/root 18904 2026-10-31 09:38 ./usr/bin/testMKVStreamer
-rwxr-xr-x root/root 14712 2026-10-31 09:38 ./usr/bin/testMP3Receiver
-rwxr-xr-x root/root 14768 2026-10-31 09:38 ./usr/bin/testMP3Streamer
-rwxr-xr-x root/root 18904 2026-10-31 09:38 ./usr/bin/testMPEG1or2AudioVideoStreamer
-rwxr-xr-x root/root 14576 2026-10-31 09:38 ./usr/bin/testMPEG1or2ProgramToTransportStream
-rwxr-xr-x root/root 14592 2026-10-31 09:38 ./usr/bin/testMPEG1or2Splitter
-rwxr-xr-x root/root 14712 2026-10-31 09:38 ./usr/bin/testMPEG1or2VideoReceiver
-rwxr-xr-x root/root 14768 2026-10-31 09:38 ./usr/bin/testMPEG1or2VideoStreamer
-rwxr-xr-x root/root 14712 2026-10-31 09:38 ./usr/bin/testMPEG2TransportReceiver
-rwxr-xr-x root/root 14536 2026-10-31 09:38 ./usr/bin/testMPEG2TransportStreamSplitter
-rwxr-xr-x root/root 14648 2026-10-31 09:38 ./usr/bin/testMPEG2TransportStreamTrickPlay
-rwxr-xr-x root/root 14768 2026-10-31 09:38 ./usr/bin/testMPEG2TransportStreamer
-rwxr-xr-x root/root 18880 2026-10-31 09:38 ./usr/bin/testMPEG4VideoStreamer
-rwxr-xr-x root/root 18912 2026-10-31 09:38 ./usr/bin/testOggStreamer
-rwxr-xr-x root/root 22952 2026-10-31 09:38 ./usr/bin/testOnDemandRTSPServer
-rwxr-xr-x root/root 23104 2026-10-31 09:38 ./usr/bin/testRTSPClient
-rwxr-xr-x root/root 14688 2026-10-31 09:38 ./usr/bin/testRelay
-rwxr-xr-x root/root 14728 2026-10-31 09:38 ./usr/bin/testReplicator
-rwxr-xr-x root/root 18904 2026-10-31 09:38 ./usr/bin/testWAVAudioStreamer
-rwxr-xr-x root/root 18944 2026-10-31 09:38 ./usr/bin/vobStreamer

We also ship:
libUsageEnvironment, libliveMedia, libgroupsock, examples and header files

G.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-ip_mreq_source-is-defined-in-all-glibc-not-just-on-k.patch
Type: text/x-patch
Size: 966 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261102/dc9c3596/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 01_propagate_cflags.patch
Type: text/x-patch
Size: 1920 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261102/dc9c3596/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-a-pkg-config-file-for-the-shared-libraries.patch
Type: text/x-patch
Size: 1882 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261102/dc9c3596/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 02_fix-link-more-lib.patch
Type: text/x-patch
Size: 3355 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261102/dc9c3596/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Link-shared-libraries-with-g-instead-of-gcc-to-fix-b.patch
Type: text/x-patch
Size: 999 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261102/dc9c3596/attachment-0004.bin>