SB2019053105 - Arch Linux update for live-media

Description

This security bulletin contains information about 2 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2019-7314)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to use-after-free error when mishandling of the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up. A remote attacker can trigger segmentation fault and cause the RTSP server to crash.

2) Buffer overflow (CVE-ID: CVE-2019-7733)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a buffer overflow condition in the handleRequestBytes function. A remote attacker can send a malicious HTTP packet and perform denial of service attack.

Remediation

Install update from vendor's website.

References

• https://security.archlinux.org/advisory/ASA-201905-17