CVE-2013-2139
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a...
CVE-2013-2139 is a low vulnerability (CVSS 2.6) in Cisco Libsrtp, published January 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in srtp 1.4.4~dfsg-6+deb6u1.
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
- Record
CVE-2013-2139- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
- Record
CVE-2013-2139- Updated
- 2026-11-02
EUVDEUVD-2013-2104 No score
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
- Record
EUVD-2013-2104- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6g5-gwj7-cvr6 No score
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a...
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
- Record
GHSA-p6g5-gwj7-cvr6- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVMGASA-2014-0465 No score
Updated srtp package fixes security vulnerability
Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the crypto_policy_set_from_profile_for_rtp() function applies cryptographic profiles to an srtp_policy. A remote attacker could exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service (CVE-2013-2139).
- Record
MGASA-2014-0465- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10265-1 No score
libsrtp-devel-1.5.4-2.1 on GA media
These are all security issues fixed in the libsrtp-devel-1.5.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10265-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10997-1 No score
libsrtp2-1-2.4.1-1.2 on GA media
These are all security issues fixed in the libsrtp2-1-2.4.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10997-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
srtpDebian:6.0 |
before 1.4.4~dfsg-6+deb6u1, plus listed versions 1.4.4~dfsg-6 |
1.4.4~dfsg-6+deb6u1 |
srtpDebian:7 |
before 1.4.4+20100615~dfsg-2+deb7u1, plus listed versions 1.4.4+20100615~dfsg-2 |
1.4.4+20100615~dfsg-2+deb7u1 |
srtpMageia:3 |
before 1.4.4-3.1.mga3 | 1.4.4-3.1.mga3 |
libsrtpRed Hat:enterprise_linux:7::client |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-develRed Hat:enterprise_linux:7::client |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtpRed Hat:enterprise_linux:7::computenode |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-develRed Hat:enterprise_linux:7::computenode |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtpRed Hat:enterprise_linux:7::server |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsrtp-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-develRed Hat:enterprise_linux:7::server |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtpRed Hat:enterprise_linux:7::workstation |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtp-develRed Hat:enterprise_linux:7::workstation |
before 0:1.4.4-11.20101004cvs.el7 | 0:1.4.4-11.20101004cvs.el7 |
libsrtpopenSUSE:Tumbleweed |
before 1.5.4-2.1 | 1.5.4-2.1 |
libsrtpopenSUSE:Tumbleweed |
before 2.4.1-1.2 | 2.4.1-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mandriva.com/security/advisories?name=MDVSA-2014:219
bugzilla.redhat.com/show_bug.cgi?id=970697
seclists.org/fulldisclosure/2013/Jun/10
lwn.net/Articles/579633
debian.org/security/2014/dsa-2840
github.com/cisco/libsrtp/pull/27
Show 21 moreShow less
advisories.mageia.org/MGASA-2014-0465.html
osvdb.org/93852
lists.opensuse.org/opensuse-updates/2014-09/msg00059.html
nvd.nist.gov/vuln/detail/CVE-2013-2139
bugs.mageia.org/show_bug.cgi?id=14200
access.redhat.com/errata/RHSA-2020:3873
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3873.json
cve.org/CVERecord?id=CVE-2013-2139
suse.com/security/cve/CVE-2013-2139