LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21863-1 advisory.

    Changes in live555:

    - Update to version 2026.08.25:
      * Fixed a bug in VorbisAudioRTPSource that could have caused a         malicious SDP description to crash a RTP client.

    - update to 2026.08.14:
      * Fixed a bug that could cause a problem with subclassed variants         of H.264 or H.265 RTP sinks.
      * Fixed old code in GroupsockHelper.cpp that was using         hardcoded numeric error numbers
      * Fixed a memory leak that could occur when parsing a SDP         description that contains two or more
      * When adding protection against the use of 'stolen' RTSP session         ids we forgot to do so for every SETUP command.  This release         fixes that.
      * Fixed a typo in RTSPCommon.cpp: smtpe -> smpte.
      * Updated the RTSP server implementation to return a Unsupported         Transport error if a SETUP request does not include a         Transport: header.
      * Added -std=c++20 to the CPLUSPLUS_FLAGS line in each         config.* file, so that std::atomic_flag::test will compile         with compilers that support
      * Made the parsing of MP3 audio files more robust to protect         against malformed MP3 data.
      * Minor change to testProgs/testRTSPClient.cpp to make         compiling on Mac OS X happier.

    - Update to version 2026.06.01:
      * Updated the RTSPServer implementation of the SETUP command         to make it more robust if subclassed code reimplements         lookupServerMediaSession() as an asynchronous operation.

    - update to 2026.05.30:
      * Updated the RTSPServer implementation some more to make it         more robust if subclassed code reimplements         lookpServerMediaSession() as an asynchronous operation.
      * Added an (integer) index to identify each server's         'client connection', and changed the fClientConnections table         to be indexed by this id.
      * In the RTSPServer implementation, removed the         fOurClientConnection member variable.
        This had been left over from when the RTSP SETUP command had         been implemented as a single, synchronous function.
        Now that SETUP is implemented using multiple functions,         possibly asynchronously (depending upon how         lookpServerMediaSession() is implemented), this member         variable was potentially dangerous if more than one SETUP is         performed concurrently on the same client connection, or on         separate client connections.

    - update to 2026.05.28:
      * fix use-after-free memory corruption introduced in fix         for CVE-2026-41470

    - Update to version 2026.04.22 (CVE-2026-41470, boo#1265856):
      * Added extra checking to the handling of the RTSP server's         PLAY, PAUSE, TEARDOWN, and SET_PARAMETER commands, to         ensure that, if the session is authenticated, then a proper         authentication check is done before these commands are handled.
        This protects against the use of a 'stolen' RTSP session id to         send these commands.  (Note, however, that if the session is         not authenticated (i.e., no username,password is needed), then no         such protection is possible.)
    - Changes from version 2026-04-01:
      * Updated the way that the RTSP server generates successive RTSP         'session ids' to make it less likely that an attacker could         guess a session id.
      * Updated the RTSP server implementation to make it possible for         a client to request both interleaved (i.e., RTP/RTCP-over-TCP)         and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within         the same session.

    - Update to version 2026.03.23 (boo#1279932):
      * CVE-2026-38998: Fixed a bug in the RTSP server code that caused         it to improperly handle non-interleaved SETUPs that were sent         for a session where interleaving (i.e., RTP/RTCP-over-TCP) had         already been SETUP.  (This could cause a 'use-after-free'         error.
      * For changes between 2024.08.01 to today, please refer to         https://download.live555.com/changelog.txt

    - update to 2024-08-01:
      * Updated ServerMediaSession::generateSDPDescription() to         treat time_t as (long long).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling     that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who     obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without     authentication, causing server crashes through virtual function call errors or disrupting active streams     by terminating victim sessions. (CVE-2026-41470)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347914	openSUSE 16: libBasicUsageEnvironment2 / libUsageEnvironment3 / libgroupsock33 / etc (openSUSE-SU-2026:21863-1)	Nessus	SuSE Local Security Checks	Local	high
316806	Linux Distros Unpatched Vulnerability : CVE-2026-41470	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-41470

high

Tenable Plugins

high

high