CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

net/liveMedia 2026.10.24,2

LIVE.COM Streaming Media

Port info

Maintainer
multimedia@FreeBSD.org
Packages
latest: 2026.10.17,2, update to 2026.10.24,2 not built yet
Upstream
up to date
Last update
to 2026.10.24,2 · 735d14f90d
Quarterly
2026Q4: 2026.10.17,2 · last MFH f0aed12710
WWW
http://www.live555.com/liveMedia/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install liveMedia
installs 2026.10.17,2 from latest; from quarterly (2026Q4) 2026.10.17,2
Port
# cd /usr/ports/net/liveMedia && make install clean
Size
556 KiB download · 2.3 MiB installed
Depends on
nothing
License
LGPL3+

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162026.10.17,22026.08.14,2–
FreeBSD 152026.10.17,22026.10.13,2–
FreeBSD 142026.10.17,22026.08.14,22026.10.17,2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152026.10.17,22026.10.13,2–
FreeBSD 142026.10.17,22026.08.14,22026.10.17,2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 2026.10.17,2.

Not counted (8)

CVEs that match this port only loosely: inherited from the whole project, or with versions that cannot be compared. What does this mean?

8 with versions that cannot be compared
The CVE record gives dates or the port uses snapshot versions (or the other way round), so the version of this port cannot be placed in the affected range.
CVECVSSPublishedDescription
CVE-2019-152329.82019-08-20Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is m…
CVE-2013-69337.52014-01-23The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers…
CVE-2013-69347.52014-01-23The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial …
CVE-2025-654076.52025-12-01A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supp…
CVE-2025-654066.52025-12-01A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) vi…
CVE-2025-654086.52025-12-01A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Deni…
CVE-2025-654046.52025-12-01A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.
CVE-2025-654056.52025-12-01A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via …

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (417)

Tobias C. Berner (tcberner) · 2020.01.19,2
net/liveMedia: update to 2020.01.19

2020.01.19:
- Updated "TLSState::read()" to allow for "SSL_read()" 'failing' with a
  SSL_ERROR_WANT_READ error code.  If this happens, we just pretend to succeed, but
  returning a read count of 0.  Fortunately, "RTSPClient" (the only code that calls
  "TLSState::read()" will handle this OK, and the read will get recalled again when ready.
- Minor improvements to the output of the "mikeyParse" demo application.
3e03dce2df
Tobias C. Berner (tcberner) · 2020.01.11,2
net/liveMedia: update to 2020.01.11

2020.01.11:
- Added a new application "mikeyParse" to "testProgs".  "mikeyParse" parses a Base64 string
  - that encodes a binary MIKEY (multimedia key management) message - and outputs a human-readable
  description of the MIKEY message. (The Base64 string could, for example, have been used in a
  SDP "a=key-mgmt:" attribute, as defined by RFC 4567.)
2020.01.10a:
- Removed a stray character that had accidentally been inserted into "config.linux-with-shared-libraries",
  preventing it from being used.
56bfb11969
Tobias C. Berner (tcberner) · 2020.01.10,2
net/livemedia: update to 2020.01.10

2020.01.10:
- Made sure that each "TaskToken" is set to NULL when its scheduled event occurs, to ensure that
  "unscheduleDelayedTask()" is never later called with it.  Also, because "unscheduleDelayedTask()"
  sets its "TaskToken&" parameter to NULL, there's no need to do this explicitly outside the call.
  (Thanks to Helmut Grohne for proposing this.)
2020.01.09:
- Improved the "MediaSession"/"MediaSubsession" SDP parsing code by moving replicated code into a
  single function.  (We also now parse the "key-mgmt" SDP attribute, although we don't yet use it.)
e326d6ecab
Tobias C. Berner (tcberner) · 2019.12.30,2
net/liveMedia: update to 2019.12.30

2019.12.30:
- Moved the definition of "class tcpStreamRecord" inside "RTPInterface.cpp", to make it clear
  that this class is intended to be used only to implement "RTPInterface".
- Added the "EXT-X-INDEPENDENT-SEGMENTS" tag to the playlist header generated by the
  "testH264VideoToHLSSegments" and "live555HLSProxy" demo applications.
2019.12.27:
- Added a new demo application "live555HLSProxy" to "testProgs".
  (Because this is still 'work in progress', it is described/documented only on our
  developers' mailing list, for now.)
2019.12.13:
- In the file "win32config" (used for generating Makefiles for Windows), moved "-DNO_OPENSSL=1" from
  "C_FLAGS" to "COMPILE_OPTS", following a suggestion.
- Changed the type of the "data" parameter in the (private) member function "RTSPClient::write()"
  from "const u_int8_t*" to "const char*", following a suggestion.  (Ditto for "TLSState::write()".)
- Removed some stray (unused) files that had accidentally got left in the "liveMedia" directory.
2019.12.10:
- Improved the handling of "npt" (Normal Play Time) times in the RTSP "Range:" header.
  (Thanks to Denis Genestier.)
2019.12.07:
- Added support to "RTSPClient" for connecting to the server via TLS (encrypted TCP).  "RTSPClient"
  will now connect via TLS if the URL begins with "rtsps://", or if the URL's port number is
  322 (the port number reserved for RTSP over TLS), or if the "useTLS()" function is called on
  the "RTSPClient" object before the first RTSP command is sent.
  (Note that only RTSP client support for TLS is implemented for now; our RTSP server implementation
  currently does not support connections over TLS.)
  Note that because applications now link with "-lssl -lcrypto", you *must* re-run "genMakefiles"
  (to generate a new Makefile) after upgrading to this version of the software.
  (If you don't wish to support RTSP-over-TLS (or if you don't have "OpenSSL"), you can avoid this
  by compling with "-DNO_OPENSSL=1")
7586f063e1
Tobias C. Berner (tcberner) · 2019.12.05,2
net/liveMedia: update to 2019.12.05

2019.12.05:
- Fixed a memory leak in the RTSP "REGISTER" command implementation
  (that I had failed to catch in the previous release).
2019.12.04:
- Fixed a couple of memory leaks in the RTSP "REGISTER" command implementation.
  (Thanks to Micha Kalfon for noting this.)
- Changed to protection of the member function "setSDPLinesFromRTPSink" in
  "OnDemandServerMediaSubsession" from "private:" to "protected:".
- Performed the annual update of the copyright years near the start of each file
eb08242a22
Tobias C. Berner (tcberner) · 2019.11.22,2
net/liveMedia: update to 2019.11.22

2019.11.22:
- Fixed a bug in the previous revision's fix to the "RTSPClient" URL parsing code.
3bc8621835
Tobias C. Berner (tcberner) · 2019.11.11,2
net/liveMedia: update to 2019.11.11

2019.11.11:
- Fixed the URL parsing code in "RTSPClient" to allow for the possibility
  of an embedded password  containing a '@'.
  (Thanks to Ha Viet for reporting this.)
- Fixed a potential memory leak in "GenericMediaServer.cpp"
  (if "addUserRecord()" is called more than once with the same user name.
  (Thanks to Jeff Shanab for reporting this.)
2447d42129
Tobias C. Berner (tcberner) · 2019.11.06,2
net/liveMedia: update to 2019.11.06

2019.11.06:
- Added a new application "testH264VideoToHLSSegments" to "testProgs".
  This demo application converts an H.264 (Elementary Stream) video file - named "in.264" - into
  a sequence of HLS ("HTTP Live Streaming") segments, plus a ".m3u8" file that can be accessed
  via a web browser.
2019.11.05:
- Added initial support for HLS (Apple's "HTTP Live Streaming"), by adding a new class "HLSSegmenter"
  that takes - as input - a MPEG Transport Stream, and outputs a series of MPEG Transport Stream
  files, each representing a segment of the input stream.
  (A demo application that illustrates this will be added (to "testProgs") shortly.)
- Completed the previous revision by adding support for "inserting access unit delimiters" to
  "H264or5VideoStreamDiscreteFramer" (rather than just to "H264or5VideoStreamFramer").
2019.11.04:
- Added a new (optional) parameter to the various H.264/H.265 'framer' classes, to tell us
  whether or not to add an "access unit delimiter" NAL unit before each output H.264/H.265 NAL unit
  that begins an 'access unit'.
  (The default behavior remains as before: Do not insert "access unit delimiters".)
2019.11.03:
- Updated "MPEG2TransportStreamMultiplexor" to support 13-bit PIDs (previously, PIDs were
  assumed to be 8 bits only), and to make the output transport streams more compatible with
  HLS-compliant transport streams.
a547a66d5d
Thomas Zander (riggs) · 2019.10.20,2
Update to upstream version 2019.10.20
f41ee371d4
Tobias C. Berner (tcberner) · 2019.10.11,2
net/liveMedia: update to 2019.10.11

Changelog:

2019.10.11:
- Some minor changes to prevent compilation errors with older, dumb compilers.
2019.10.10:
- Added optional support to "MPEG2TransportStreamMultiplexor" for 'segmenting' the output
  Transport Stream (by inserting a PAT and PMT Transport packet) every 'n' seconds.
  (Also, an optional handler function is called whenever such a segment has completed.)
- Fixed a problem with the definition of "MPEG2TransportStreamParser" that could trip up some
  compilers.  (Thanks to Denis Genestier for reporting this.)
2019.09.30:
- Fixed a bug in "GenericMediaServer.cpp" (accidentally introduced in version 2019.08.10) that
  could cause an infinite recursion error in the "LIVE555 Media Server".
  (Thanks to Yi Xiansheng for reporting this.)
2019.09.18:
- Fixed a potential NULL pointer access error in "MatroskaFile.cpp" (if the input file contained
  a H.264 or H.265 track without proper VPS,SPS,PPS NAL unit information)
2019.09.17:
- Added some more debugging statements to "RTSPServer.cpp" in hope of resolving an issue that
  someone has seen with the "LIVE555 Proxy Server".
2019.08.28:
- Changed the implementation of "RTSPClient::sendGetParameterCommand()" to send no body in
  the request if the "parameterName" is "" (not just NULL), because otherwise it supposedly
  confuses some servers otherwise.  (Thanks to Sergei Gagarin for reporting this problem.)
2019.08.16:
- Changed the way that "GenericMediaServer::createNewClientSessionWithId()" generates new
  client session ids so that it avoids generating the same client session id in succession.
  (This avoids confusing the MPEG1or2 and Matroska file demultiplexors, potentially causing an
  'access after delete' error.)
  (Thanks to Thuan Pham and Marcel Boehme from Monash University for reporting this.)
2019.08.12:
- Updated "H264or5VideoStreamParser::analyze_sei_payload()" to properly set the frame rate
  for H.265 streams when "frame_field_info_present_flag" is not set.
  (Thanks to Charles Yu for reporting this issue.)
52e5179db3
Mathieu Arnold (mat) · 2019.08.11,2
Convert to UCL & cleanup pkg-message (categories n)

(and missed 3 missed files from previous categories.)
2614c95748
Piotr Kubaj (pkubaj) · 2019.08.11,2
net/liveMedia: fix build with GCC-based architectures

Use C++11 compiler:
MPEG2TransportStreamParser.hh:107: error: a class-key must be used when declaring a friend

Approved by:    mentors (implicit approval)
af67b6ba53
Thomas Zander (riggs) · 2019.08.11,2
Update to upstream release 2019.08.11

Details:
- Upstream release 2019.08.11 adds new feature:
  demultiplexing support for MPEG Transport Streams
4306decedb
Tobias C. Berner (tcberner) · 2019.06.28,2
net/liveMedia: update to 2019.06.28

Changelog:
	2019.06.28:
	- Changed the visibility of some fields of
	  "PassiveServerMediaSubsession" from "private:" to "protected:" - as
	  requested by Zhang Qian.
6e95864c07
Thomas Zander (riggs) · 2019.05.29,2
Update to upstream version 2019.05.29 (bug fix release)
b5e5c2fcd6
Tobias C. Berner (tcberner) · 2019.05.21,2
net/liveMedia: update to 2019.05.21

From the changelog:
  - Added new classes "JPEG2000VideoRTPSink" and "JPEG2000VideoRTPSource" for
    sending/receiving JPEG 2000 video in RTP - as specified in RFC 5371.
    (Thanks to Francois Bonnissent for providing the initial implementation.)
10cf38f1e3
Tobias C. Berner (tcberner) · 2019.05.12,2
net/liveMedia: update to 2019.05.12
d149519a75
Tobias C. Berner (tcberner) · 2019.03.06,2
net/liveMedia: update to 2019.03.06
8d9614814b
Thomas Zander (riggs) · 2018.12.14,2
Update to upstream release as of 2018.12.14

Details:
- Added support for sending (and handling) RTCP "BYE" packets that
  contain a 'reason' string.
- Fixed a bug in the server implementation of RTSP-over-HTTP to
  prevent a potential denial-of-service attack.
- Upstream changelog, see:
  http://www.live555.com/liveMedia/public/changelog.txt

MFH:		2018Q4
0fb47d33c8
Thomas Zander (riggs) · 2018.10.17,2
Update to upstream version 2018.10.17

Details:
- Fix potential remote exploit in the RTSP code (CVE-2018-4013)

MFH:		2018Q4
Security:	CVE-2018-4013
2f81c7e4b9
Baptiste Daroussin (bapt) · 2018.02.28,2
Update to 2018.02.28
75f69bc483
Baptiste Daroussin (bapt) · 2017.09.12,2
Update to 2017.09.12
b7ca3ddd10
Mark Linimon (linimon) · 2017.01.26,2
Begin deorbit burn of ia64.  We have not attempted to build packages for it for many years.

While here, alphabetize ARCHs, pet portlint, and modernize usages.

Approved by:	portmgr (tier-2 blanket)
45cb752a04
Baptiste Daroussin (bapt) · 2017.01.26,2
Update to 2017.01.26
f5b6764527
Baptiste Daroussin (bapt) · 2016.11.28,2
Update to 2016-11-28
8652a24bd7
Baptiste Daroussin (bapt) · 2016.11.17,2
Update to 2016-11-17
c8c7a4f154
Baptiste Daroussin (bapt) · 2016.11.06,2
Update liveMedia 2016-11-06 Remove useless patches Add videolan mirrors which keeps distfiles around for a while
15d7dfcbe9
Thomas Zander (riggs) · 2014.12.17_1,2
Fix build failure on pre-10 systems
45ef0b001f
Thomas Zander (riggs) · 2014.12.17_1,2
- Ensure that PREFIX is respected - Pet portlint

PR:		196162
Submitted by:	mi@ALDAN.algebra.com
5f71d61e78
Thomas Zander (riggs) · 2014.12.17,2
Update to upstream version 2014.12.17
85c13fe2ff
Antoine Brodin (antoine) · 2013.11.29,2
Cleanup plist
1d7f5e5c0f
John Marino (marino) · 2013.11.29,2
net/liveMedia: Fix building on DF, no-op for FreeBSD
0a6e479f1e
Baptiste Daroussin (bapt) · 2013.11.29,2
Convert all :U to :tu and :L to :tl

Since FreeBSD 8.4 and FreeBSD 9.1 make(1) do support :tu and :tl as a
replacement for :U and :L (which has been marked as deprecated)

bmake which is the default on FreeBSD 10+ only support by default
:tu/:tl a hack has been added at the time to support :U and :L to ease
migration. This hack is now not necessary anymore

Note that this makes the ports tree incompatible with make(1) from
FreeBSD 8.3 or earlier

With hat:	portmgr
4a4ec28d37
Thierry Thomas (thierry) · 2013.11.29,2
- Stagify;

- it seems that we can now use the targets supplied by upstream,
so that the port installs now as intended and like on the
other platforms;

- switch to shared libraries, so that we shall be able to apply
minor upgrades without rebuilding its consumers;

- chase this upgrade in mplayer and vlc.

PR:		ports/184035
Submitted by:	/me
00be22f3cc
William Grzybowski (wg) · 2013.11.29,2
net/liveMedia: fix plist
2d215ba50e
William Grzybowski (wg) · 2013.11.29,2
net/liveMedia: update to 2013.11.29

- Update to 2013.11.29
- Put the distfile in my LOCAL distfiles as it will get removed in upstream
- Pass maintainership to multimedia
c45b216863
Mark Linimon (linimon) · 2013.08.31,2
Reset maintainer at his request.

PR:	ports/184260
bfd16aa9fa
Baptiste Daroussin (bapt) · 2013.08.31,2
Add NO_STAGE all over the place in preparation for the staging support (cat: net)
0c710c7b4e
Thierry Thomas (thierry) · 2013.08.31,2
- Upgrade to 2013.08.31 	Changelog at <http://www.live555.com/liveMedia/public/changelog.txt>

- Change the license to LGPL21

- Add a mirror to SF.

PR:		ports/181907
Submitted by:	maintainer
bf6fda0b70
William Grzybowski (wg) · 2013.08.16,2
net/liveMedia: update to 2013.08.16

- Update to 2013.08.16 [1]
- Unmute install commands

PR:		ports/181429 [1]
Submitted by:	Chris Petrik <c.petrik.sosa@gmail.com> (maintainer)
f5b5af8d2b
Alex Kozlov (ak) · 2013.04.30,2
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Bryan Drewery (bdrewery) · 2013.04.30,2
- Update to 2013.04.30

PR:		ports/178633
Submitted by:	Chris Petrik <c.petrik.sosa@gmail.com> (maintainer)
4e2778dc05
Bryan Drewery (bdrewery) · 2013.03.23,2
- Update to 2013.03.23

PR:		ports/177330
Submitted by:	Chris Petrik <c.petrik.sosa@gmail.com> (maintainer)
b8aac85c47
Bryan Drewery (bdrewery) · 2013.03.07,2
Mirror the distfile as upstream has bad habits of removing the last version on updates.

Reported by:	bapt
320c5b87e0
Bryan Drewery (bdrewery) · 2013.03.07,2
- Update to 2013.03.07

PR:		ports/177027
Submitted by:	Chris Petrik <c.petrik.sosa@gmail.com> (maintainer)
18186a423f
Bryan Drewery (bdrewery) · 2012.12.18,2
- Please welcome back Chris Petrik as maintainer of   these ports [1] - Trim headers - Remove indefinite article from COMMENT - Convert tab to space in WWW lines

PR:		ports/175415 [1]
Submitted by:	Chris Petrik <c.petrik.sosa@gmail.com> [1]
Discussed with:	bapt
6910bf819a
Baptiste Daroussin (bapt) · 2012.12.18,2
Readd portepoch that shouldn't have been removed

Pointyhat to:	bapt
Reported by:	pawel
c3efd79a43
Baptiste Daroussin (bapt) · 2012.12.18
- update to 2012-12-18 - mirror the distfile has upstream seem to like dropping it after each new   releases
bf6e6ec4f4
Marcus von Appen (mva) · 2012.11.30_1,2
- Install missing header - Bump PORTREVISION to make ports depending on liveMedia buildable again
a9465ae68e
Eitan Adler (eadler) · 2012.11.30,2
Revert Chris Petrik's ports to the pool.  Thank you for all your work so far, and should you desire to return just let us know.

PR:		ports/174309
Submitted by:	Chris Petrik
a52b1a298c