Stay Secure with the Latest Linux Advisories

security advisorymedia playerMplayer

Mageia: 2019-0121 Moderate: RTSP Stream Handling Errors in Mplayer and VLC

The updated live, mplayer, vlc packages fix security vulnerabilities: liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation . MGASA-2019-0121 - Updated live, mplayer, vlc packages fix security vulnerability Publication date: 29 Mar 2019 URL: https://advisories.mageia.org/MGASA-2019-0121.html Type: security Affected Mageia releases: 6 CVE: CVE-2019-7314, CVE-2019-9215 The updated live, mplayer, vlc packages fix security vulnerabilities: liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. (CVE-2019-7314) In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. (CVE-2019-9215) Mplayer and VLC has been rebuilt against new live packages. Also, VLC has been updated to version 3.0.6. References: - https://bugs.mageia.org/show_bug.cgi?id=24527 - https://lists.debian.org/debian-security-announce/2019/msg00052.html - https://code.videolan.org/videolan/vlc-3.0/-/raw/master/NEWS - - https://www.cve.org/CVERecord?id=CVE-2019-7314 - https://www.cve.org/CVERecord?id=CVE-2019-9215 SRPMS: - 6/tainted/mplayer-1.3.0-14.mga6.tainted - 6/tainted/vlc-3.0.6-1.mga6.tainted - 6/core/live-2019.03.06-1.mga6 - 6/core/mplayer-1.3.0-14.mga6 - 6/core/vlc-3.0.6-1.mga6 . Essential Mageia security patch for live, mplayer, and VLC packages tackles vulnerabilities in RTSP stream management.. Mageia Security Advisory, Media Player Risks, RTSP Handling Issues. . Severity: Important. LinuxSecurity.com Team

Mar 29, 2019 •Important Mageia