Vulnerability in Live555 Streaming Media
CVE-2013-6934
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.282 (98.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.282 · newest: 0.282 · change: 0.000
Affected products
- Live555 Streaming Media — versions 2013-11-26
- Videolan Vlc Media Player
Weakness classification (CWE)
References
- www.securityfocus.com/bid/65139 (VDB Entry, Third Party Advisory, vdb-entry)
- www.live555.com/liveMedia/public/changelog.txt (Vendor Advisory)
- isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.html (Exploit, Third Party Advisory)