[Live-devel] two security fixes for live555?

[Ross Finlayson]

> On Oct 31, 2026, at 2:59 AM, Gianfranco Costamagna <locutusofborg at debian.org> wrote:
> 
> I admit that CVE shouldn't have been opened in first place, but now the easiest way is to provide a fix and be CVE free :D

But there’s nothing here to ‘fix’, because that CVE is completely wrong.  Furthermore, it was not filed against our code, but against someone else’s GitHub repository (which has already heavily modified our code).

It would be best if you not modify our code at all; see http://live555.com/liveMedia/faq.html#modifying-and-extending

(As an aside, I’d personally prefer that Linux distributions *not* include copies of the “LIVE555 Streaming Media” code.  But if they do, then they should include the latest version (currently, 2026.10.29); see http://live555.com/liveMedia/faq.html#latest-version .  Note that, to my knowledge, the code is not used at all in any Linux *kernel*.)


Ross Finlayson
Live Networks, Inc.
http://www.live555.com/