[Live-devel] two security fixes for live555?

[Gianfranco Costamagna]

Hello, I'm attaching two fixes, one is a leak discovered while checking for fixes of CVE-2019-7732, there might be an allocation of new fields without a proper free

The second one is a new one, the streamname provided by the client, becomes a filesystem path. Requesting a path with "../" can lead to files outside the media server to be played as well. I don't know if this is intended or not.

please have a look and apply if possible, so we can have a CVE-free liblivemedia in Debian :)


Gianfranco
-------------- next part --------------
A non-text attachment was scrubbed...
Name: directory-traversal.patch
Type: text/x-patch
Size: 5261 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261030/53bfaec2/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CVE-2019-7732.patch
Type: text/x-patch
Size: 1088 bytes
Desc: not available
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20261030/53bfaec2/attachment-0001.bin>