[Live-devel] two security fixes for live555?

[Gianfranco Costamagna]

Hello, thanks for getting back to me!
I will disable the two patches, even if I still consider the "delete" to be safe and prone to future implementation errors (and easy to keep the Debian
security team quiet :) )

I admit that CVE shouldn't have been opened in first place, but now the easiest way is to provide a fix and be CVE free :D

G.






Il giorno venerdì 30 ottobre 2026 alle ore 10:24:40 CET, Gianfranco Costamagna <locutusofborg at debian.org> ha scritto: 





Hello, I'm attaching two fixes, one is a leak discovered while checking for fixes of CVE-2019-7732, there might be an allocation of new fields without a proper free

The second one is a new one, the streamname provided by the client, becomes a filesystem path. Requesting a path with "../" can lead to files outside the media server to be played as well. I don't know if this is intended or not.

please have a look and apply if possible, so we can have a CVE-free liblivemedia in Debian :)


Gianfranco