DEBIAN-CVE-2026-41470

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-41470
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41470.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-41470
Upstream
  • CVE-2026-41470
Published
2026-05-19T19:16:50Z
Modified
2026-10-05T04:00:11Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

References

Affected packages

Debian:14 / liblivemedia

Package

Name
liblivemedia
Purl
pkg:deb/debian/liblivemedia?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.09.23-dfsg-1

Affected versions

2004.*
2004.11.11a-1
2005.*
2005.04.01-1
2005.06.16-1
2005.07.21-1
2005.10.05-1
2006.*
2006.03.17-1
2006.03.17-2
2007.*
2007.02.20-1
2007.02.20-2
2008.*
2008.07.25-1
2008.07.25-2
2009.*
2009.11.27-1
2010.*
2010.02.10-1
2010.04.09-1
2010.11.17-1
2011.*
2011.03.14-1
2011.05.25-1
2011.06.16-1
2011.07.08-1
2011.07.21-1
2011.08.22-1
2011.09.02-1
2011.12.23-1
2012.*
2012.02.04-1
2012.02.29-1
2012.02.29-2
2012.04.04-1
2012.04.21-1
2012.05.03-1~bpo60+1
2012.05.03-1
2012.05.17-1~bpo60+1
2012.05.17-1
2012.05.17-1+wheezy1
2012.08.31-1
2012.10.24-1
2012.11.16-1
2012.11.30-1
2013.*
2013.01.05-1
2013.01.05-2
2013.01.05-3
2013.01.15-1
2013.04.30-1
2013.10.25-1
2014.*
2014.01.13-1
2015.*
2015.12.22-1
2016.*
2016.01.12-1
2016.01.16-1
2016.01.20-1
2016.01.29-1
2016.01.29-2
2016.02.09-1
2016.03.16-1
2016.04.01-1
2016.04.21-1
2016.06.26-1
2016.07.19-1
2016.08.07-1
2016.08.27-1
2016.09.22-1
2016.11.06-1
2016.11.17-1
2016.11.28-1
2017.*
2017.01.26-1
2017.04.10-1
2017.04.26-1
2017.06.04-1
2017.06.04-2
2017.07.18-1
2017.09.12-1
2017.10.28-1
2017.10.28-2
2018.*
2018.01.24-1
2018.01.29-1
2018.02.18-1
2018.02.28-1
2018.04.25-1
2018.04.25-2
2018.07.07-1
2018.08.05-1
2018.08.27-1
2018.08.27-2
2018.08.28a-1
2018.09.06-1
2018.09.10-1
2018.09.18-1
2018.10.17-1
2018.11.26-1
2018.11.26-1.1
2019.*
2019.02.03-1
2019.02.27-1
2019.03.06-1
2019.04.24-1
2019.05.12-1
2019.06.28-1
2019.07.27-1
2019.08.16-1
2019.08.28-1
2019.09.30-1
2019.10.11-1
2019.10.11-2
2020.*
2020.01.11-1
2020.01.19-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41470.json"