CVE-2013-6933
NoneCVSS
—
EPSS
17.4%
Published
Jan 23, 2014
CISA due date
—
The record
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | mplayer | 0 | 2:1.1.1+svn37434-1 |
| Debian:11 | mplayer | 0 | 2:1.1.1+svn37434-1 |
| Debian:11 | vlc | 0 | 2.1.4-1 |
| Debian:12 | mplayer | 0 | 2:1.1.1+svn37434-1 |
| Debian:12 | vlc | 0 | 2.1.4-1 |
| Debian:13 | mplayer | 0 | 2:1.1.1+svn37434-1 |
| Debian:13 | vlc | 0 | 2.1.4-1 |
| Debian:7 | liblivemedia | 0 | 2012.05.17-1+wheezy1 |
| Debian:7 | mplayer | 0 | 2:1.0~rc4.dfsg1+svn34540-1+deb7u1 |
| Debian:7 | vlc | 0 | 2.0.3-5+deb7u2 |
| Ubuntu:14.04:LTS | liblivemedia | 0 | 2014.01.13-1 |
| Ubuntu:16.04:LTS | liblivemedia | 0 | 2016.02.09-1 |
| Ubuntu:18.04:LTS | liblivemedia | 0 | 2018.02.18-1 |
Related vulnerabilities
- CVE-2022-38861 The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via… Also affects mplayer
- CVE-2022-38864 Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function… Also affects mplayer
- CVE-2008-3827 Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and… Also affects mplayer
- CVE-2008-1558 Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in… Also affects mplayer
- CVE-2011-3625 Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer… Also affects mplayer
- CVE-2007-4938 Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows… Also affects mplayer
- CVE-2004-0386 Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows… Also affects mplayer
- CVE-2024-46461 VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer… Also affects vlc