Vulnerability-Lookup

OPENSUSE-SU-2026:21863-1

Vulnerability from csaf_opensuse - Published: 2026-09-16 15:16 - Updated: 2026-09-17 17:44

Summary

Security update for live555

Severity

Important

Notes

Title of the patch: Security update for live555

Description of the patch: This update for live555 fixes the following issues: Changes in live555: - Update to version 2026.08.25: * Fixed a bug in "VorbisAudioRTPSource" that could have caused a malicious SDP description to crash a RTP client. - update to 2026.08.14: * Fixed a bug that could cause a problem with subclassed variants of H.264 or H.265 RTP sinks. * Fixed old code in "GroupsockHelper.cpp" that was using hardcoded numeric error numbers * Fixed a memory leak that could occur when parsing a SDP description that contains two or more * When adding protection against the use of 'stolen' RTSP session ids we forgot to do so for every "SETUP" command. This release fixes that. * Fixed a typo in "RTSPCommon.cpp": "smtpe" -> "smpte". * Updated the RTSP server implementation to return a "Unsupported Transport" error if a "SETUP" request does not include a "Transport:" header. * Added "-std=c++20" to the "CPLUSPLUS_FLAGS" line in each "config.*" file, so that "std::atomic_flag::test" will compile with compilers that support * Made the parsing of MP3 audio files more robust to protect against malformed MP3 data. * Minor change to "testProgs/testRTSPClient.cpp" to make compiling on Mac OS X happier. - Update to version 2026.06.01: * Updated the "RTSPServer" implementation of the "SETUP" command to make it more robust if subclassed code reimplements "lookupServerMediaSession()" as an asynchronous operation. - update to 2026.05.30: * Updated the "RTSPServer" implementation some more to make it more robust if subclassed code reimplements "lookpServerMediaSession()" as an asynchronous operation. * Added an (integer) index to identify each server's 'client connection', and changed the "fClientConnections" table to be indexed by this id. * In the "RTSPServer" implementation, removed the "fOurClientConnection" member variable. This had been left over from when the RTSP "SETUP" command had been implemented as a single, synchronous function. Now that "SETUP" is implemented using multiple functions, possibly asynchronously (depending upon how "lookpServerMediaSession()" is implemented), this member variable was potentially dangerous if more than one "SETUP" is performed concurrently on the same client connection, or on separate client connections. - update to 2026.05.28: * fix use-after-free memory corruption introduced in fix for CVE-2026-41470 - Update to version 2026.04.22 (CVE-2026-41470, boo#1265856): * Added extra checking to the handling of the RTSP server's "PLAY", "PAUSE", "TEARDOWN", and "SET_PARAMETER" commands, to ensure that, if the session is authenticated, then a proper authentication check is done before these commands are handled. This protects against the use of a 'stolen' RTSP session id to send these commands. (Note, however, that if the session is not authenticated (i.e., no username,password is needed), then no such protection is possible.) - Changes from version 2026-04-01: * Updated the way that the RTSP server generates successive RTSP 'session ids' to make it less likely that an attacker could guess a session id. * Updated the RTSP server implementation to make it possible for a client to request both interleaved (i.e., RTP/RTCP-over-TCP) and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within the same session. - Update to version 2026.03.23 (boo#1279932): * CVE-2026-38998: Fixed a bug in the RTSP server code that caused it to improperly handle non-interleaved "SETUP"s that were sent for a session where interleaving (i.e., RTP/RTCP-over-TCP) had already been "SETUP". (This could cause a 'use-after-free' error. * For changes between 2024.08.01 to today, please refer to https://download.live555.com/changelog.txt - update to 2024-08-01: * Updated "ServerMediaSession::generateSDPDescription()" to treat "time_t" as (long long).

Patchnames: openSUSE-Leap-16.0-packagehub-595

CVE-2026-38998

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 24 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-41470

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 24 products, the same list as for CVE-2026-38998

Threats

Impact moderate

References

10 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1265856	self
https://bugzilla.suse.com/1279932	self
https://www.suse.com/security/cve/CVE-2026-38998/	self
https://www.suse.com/security/cve/CVE-2026-41470/	self
https://www.suse.com/security/cve/CVE-2026-38998	external
https://bugzilla.suse.com/1279932	external
https://www.suse.com/security/cve/CVE-2026-41470	external
https://bugzilla.suse.com/1265856	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for live555",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for live555 fixes the following issues:\n\nChanges in live555:\n\n- Update to version 2026.08.25:\n  * Fixed a bug in \"VorbisAudioRTPSource\" that could have caused a\n    malicious SDP description to crash a RTP client.\n\n- update to 2026.08.14:\n  * Fixed a bug that could cause a problem with subclassed variants\n    of H.264 or H.265 RTP sinks.\n  * Fixed old code in \"GroupsockHelper.cpp\" that was using\n    hardcoded numeric error numbers\n  * Fixed a memory leak that could occur when parsing a SDP\n    description that contains two or more\n  * When adding protection against the use of \u0027stolen\u0027 RTSP session\n    ids we forgot to do so for every \"SETUP\" command.  This release\n    fixes that.\n  * Fixed a typo in \"RTSPCommon.cpp\": \"smtpe\" -\u003e \"smpte\".\n  * Updated the RTSP server implementation to return a \"Unsupported\n    Transport\" error if a \"SETUP\" request does not include a\n    \"Transport:\" header.\n  * Added \"-std=c++20\" to the \"CPLUSPLUS_FLAGS\" line in each\n    \"config.*\" file, so that \"std::atomic_flag::test\" will compile\n    with compilers that support\n  * Made the parsing of MP3 audio files more robust to protect\n    against malformed MP3 data.\n  * Minor change to \"testProgs/testRTSPClient.cpp\" to make\n    compiling on Mac OS X happier.\n\n- Update to version 2026.06.01:\n  * Updated the \"RTSPServer\" implementation of the \"SETUP\" command\n    to make it more robust if subclassed code reimplements\n    \"lookupServerMediaSession()\" as an asynchronous operation.\n\n- update to 2026.05.30:\n  * Updated the \"RTSPServer\" implementation some more to make it\n    more robust if subclassed code reimplements\n    \"lookpServerMediaSession()\" as an asynchronous operation.\n  * Added an (integer) index to identify each server\u0027s\n    \u0027client connection\u0027, and changed the \"fClientConnections\" table\n    to be indexed by this id.\n  * In the \"RTSPServer\" implementation, removed the\n    \"fOurClientConnection\" member variable.\n    This had been left over from when the RTSP \"SETUP\" command had\n    been implemented as a single, synchronous function.\n    Now that \"SETUP\" is implemented using multiple functions,\n    possibly asynchronously (depending upon how\n    \"lookpServerMediaSession()\" is implemented), this member\n    variable was potentially dangerous if more than one \"SETUP\" is\n    performed concurrently on the same client connection, or on\n    separate client connections.\n\n- update to 2026.05.28:\n  * fix use-after-free memory corruption introduced in fix\n    for CVE-2026-41470\n\n- Update to version 2026.04.22 (CVE-2026-41470, boo#1265856):\n  * Added extra checking to the handling of the RTSP server\u0027s\n    \"PLAY\", \"PAUSE\", \"TEARDOWN\", and \"SET_PARAMETER\" commands, to\n    ensure that, if the session is authenticated, then a proper\n    authentication check is done before these commands are handled.\n    This protects against the use of a \u0027stolen\u0027 RTSP session id to\n    send these commands.  (Note, however, that if the session is\n    not authenticated (i.e., no username,password is needed), then no\n    such protection is possible.)\n- Changes from version 2026-04-01:\n  * Updated the way that the RTSP server generates successive RTSP\n    \u0027session ids\u0027 to make it less likely that an attacker could\n    guess a session id.\n  * Updated the RTSP server implementation to make it possible for\n    a client to request both interleaved (i.e., RTP/RTCP-over-TCP)\n    and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within\n    the same session.\n\n- Update to version 2026.03.23 (boo#1279932):\n  * CVE-2026-38998: Fixed a bug in the RTSP server code that caused\n    it to improperly handle non-interleaved \"SETUP\"s that were sent\n    for a session where interleaving (i.e., RTP/RTCP-over-TCP) had\n    already been \"SETUP\".  (This could cause a \u0027use-after-free\u0027\n    error.\n  * For changes between 2024.08.01 to today, please refer to\n    https://download.live555.com/changelog.txt\n\n- update to 2024-08-01:\n  * Updated \"ServerMediaSession::generateSDPDescription()\" to\n    treat \"time_t\" as (long long).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-595",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21863-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265856",
        "url": "https://bugzilla.suse.com/1265856"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1279932",
        "url": "https://bugzilla.suse.com/1279932"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-38998 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-38998/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41470 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41470/"
      }
    ],
    "title": "Security update for live555",
    "tracking": {
      "current_release_date": "2026-09-17T17:44:48Z",
      "generator": {
        "date": "2026-09-16T15:16:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21863-1",
      "initial_release_date": "2026-09-16T15:16:27Z",
      "revision_history": [
        {
          "date": "2026-09-16T15:16:27Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-17T17:44:48Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libBasicUsageEnvironment2@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libUsageEnvironment3@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libgroupsock33@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libliveMedia120@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "live555-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "live555-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-devel-0:2026.08.25-bp160.1.1.aarch64",
                "product": {
                  "name": "live555-devel-0:2026.08.25-bp160.1.1.aarch64",
                  "product_id": "live555-devel-0:2026.08.25-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555-devel@2026.08.25-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libBasicUsageEnvironment2@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libUsageEnvironment3@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libgroupsock33@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libliveMedia120@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "live555-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "live555-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
                "product": {
                  "name": "live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_id": "live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555-devel@2026.08.25-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libBasicUsageEnvironment2@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libUsageEnvironment3@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libgroupsock33@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libliveMedia120@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "live555-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "live555-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-devel-0:2026.08.25-bp160.1.1.s390x",
                "product": {
                  "name": "live555-devel-0:2026.08.25-bp160.1.1.s390x",
                  "product_id": "live555-devel-0:2026.08.25-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555-devel@2026.08.25-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libBasicUsageEnvironment2@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libUsageEnvironment3@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libgroupsock33@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libliveMedia120@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "live555-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "live555-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "live555-devel-0:2026.08.25-bp160.1.1.x86_64",
                "product": {
                  "name": "live555-devel-0:2026.08.25-bp160.1.1.x86_64",
                  "product_id": "live555-devel-0:2026.08.25-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/live555-devel@2026.08.25-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgroupsock33-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgroupsock33-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgroupsock33-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libliveMedia120-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libliveMedia120-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libliveMedia120-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "live555-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "live555-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "live555-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "live555-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-devel-0:2026.08.25-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64"
        },
        "product_reference": "live555-devel-0:2026.08.25-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-devel-0:2026.08.25-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le"
        },
        "product_reference": "live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-devel-0:2026.08.25-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x"
        },
        "product_reference": "live555-devel-0:2026.08.25-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "live555-devel-0:2026.08.25-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
        },
        "product_reference": "live555-devel-0:2026.08.25-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-38998",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-38998"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-38998",
          "url": "https://www.suse.com/security/cve/CVE-2026-38998"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279932 for CVE-2026-38998",
          "url": "https://bugzilla.suse.com/1279932"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-16T15:16:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-38998"
    },
    {
      "cve": "CVE-2026-41470",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41470"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
          "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41470",
          "url": "https://www.suse.com/security/cve/CVE-2026-41470"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265856 for CVE-2026-41470",
          "url": "https://bugzilla.suse.com/1265856"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libBasicUsageEnvironment2-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libUsageEnvironment3-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libgroupsock33-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libliveMedia120-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-0:2026.08.25-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.s390x",
            "openSUSE Leap 16.0:live555-devel-0:2026.08.25-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-16T15:16:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41470"
    }
  ]
}

CVE-2026-38998 (GCVE-0-2026-38998)

Vulnerability from cvelistv5 – Published: 2026-09-09 00:00 – Updated: 2026-09-14 12:15

Summary

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 12:15 UTC

CWE

n/a
CWE-416 - Use After Free

Assigner

mitre mitre root

References

3 references

URL	Tags
http://lists.live555.com/pipermail/live-devel/202…
https://download.live555.com/changelog.txt
https://github.com/archersec/security-advisories/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-38998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T12:15:15.332221Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T12:15:58.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T19:16:32.390Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "http://lists.live555.com/pipermail/live-devel/2026-March/022789.html"
        },
        {
          "url": "https://download.live555.com/changelog.txt"
        },
        {
          "url": "https://github.com/archersec/security-advisories/blob/master/live555/live555-advisory-2026.md"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-38998",
    "datePublished": "2026-09-09T00:00:00.000Z",
    "dateReserved": "2026-04-06T00:00:00.000Z",
    "dateUpdated": "2026-09-14T12:15:58.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41470 (GCVE-0-2026-41470)

Vulnerability from cvelistv5 – Published: 2026-05-19 18:43 – Updated: 2026-07-14 20:00 X_Open Source

Title

LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token

Summary

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-20 14:03 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://gist.github.com/yhcho0405/ee9b67a96808ef1…	technical-descriptionexploit
https://download.live555.com/	patchproduct
https://www.vulncheck.com/advisories/live555-rtsp…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Live Networks, Inc.	LIVE555	Affected: 0 , < 2026.04.22 (custom) cpe:2.3:a:live555:live555::::::::

Date Public

2026-04-27 00:00

Credits

Younghyo Cho @ CIS Lab., Seoultech VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41470",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T14:03:45.166155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T14:04:14.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "LIVE555",
          "vendor": "Live Networks, Inc.",
          "versions": [
            {
              "lessThan": "2026.04.22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:live555:live555:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2026.04.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Younghyo Cho @ CIS Lab., Seoultech"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T20:00:54.364Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f"
        },
        {
          "tags": [
            "patch",
            "product"
          ],
          "url": "https://download.live555.com/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "LIVE555 \u003c 2026.04.22 RTSP Server Authorization Bypass via Session Token",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-41470",
    "datePublished": "2026-05-19T18:43:49.652Z",
    "dateReserved": "2026-04-20T16:07:47.311Z",
    "dateUpdated": "2026-07-14T20:00:54.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:21863-1

CVE-2026-38998 (GCVE-0-2026-38998)

CVE-2026-41470 (GCVE-0-2026-41470)

Tags

Sightings

Nomenclature

Related by attack behaviour