CVE-2004-0433 Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow re...
HighCVSS 10.0
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mplayer | = 1.0_pre3try2 | No fix listed |
| xine-lib | = 1_beta1 | No fix listed |
| xine-lib | = 1_beta2 | No fix listed |
| xine-lib | = 1_beta3 | No fix listed |
| xine-lib | = 1_beta4 | No fix listed |
| xine-lib | = 1_beta5 | No fix listed |
| xine-lib | = 1_beta6 | No fix listed |
| xine-lib | = 1_beta7 | No fix listed |
| xine-lib | = 1_beta8 | No fix listed |
| xine-lib | = 1_beta9 | No fix listed |
| xine-lib | = 1_beta10 | No fix listed |
| xine-lib | = 1_beta11 | No fix listed |
| xine-lib | = 1_rc2 | No fix listed |
| xine-lib | = 1_rc3a | No fix listed |
| xine-lib | = 1_rc3b | No fix listed |
| xine-lib | = 1_rc3c | No fix listed |
| debian/mplayer(Debian:12) | < 1.0~pre6a-1 | 1.0~pre6a-1 |
| debian/mplayer(Debian:13) | < 1.0~pre6a-1 | 1.0~pre6a-1 |
| debian/mplayer(Debian:14) | < 1.0~pre6a-1 | 1.0~pre6a-1 |
References
- GLSA-200405-24 vendor-advisory
- www.xinehq.de
- mplayer-rtsp-rdt-bo(16019) vdb-entry
- Debian Security Tracker CVE-2004-0433 vendor-advisory