CVE-2019-6256

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/rgaufman/live555/issues/19Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00037.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/22Issue Tracking, Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202005-06
https://www.debian.org/security/2019/dsa-4408Third Party Advisory
https://github.com/rgaufman/live555/issues/19Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00037.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/22Issue Tracking, Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202005-06
https://www.debian.org/security/2019/dsa-4408Third Party Advisory

Timeline

Published: Jan 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-62577.7A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal CVE-2019-62589.8D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo CVE-2019-62599.8An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter.CVE-2019-62609.8The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) brid CVE-2019-62616.1An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.CVE-2019-62625.4An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS.CVE-2019-62634.8An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.CVE-2019-62646.1An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.CVE-2019-62657.8The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecu CVE-2019-62669.8Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patt CVE-2019-62676.1The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log vie CVE-2019-62687.5RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as d