CVE-2013-6934 The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly...
HighCVSS 7.5
EPSS 28.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| live555 streaming media | = 2013-11-26 | No fix listed |
| videolan vlc media player | < 2.1.0 | 2.1.0 |
References
- isecpartners.github.io exploit third-party-advisory
- www.live555.com vendor-advisory
- 65139 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2013-6934 vendor-advisory