CVE-2013-2223
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized...
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
Exploit likelihood
What each source reports
NVD Score used
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
CVE-2013-2223- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
CVE-2013-2223- Updated
- 2026-11-02
EUVDEUVD-2013-2176 No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
EUVD-2013-2176- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjxq-qhvw-jj4x No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized...
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
GHSA-xjxq-qhvw-jj4x- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10304-1 No score
libzrtpcpp-devel-4.6.4-1.1 on GA media
These are all security issues fixed in the libzrtpcpp-devel-4.6.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10304-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2223 No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
UBUNTU-CVE-2013-2223- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2223 is a medium vulnerability (CVSS 5.8) in Wernerd Zrtpcpp, published October 4, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-updates/2013-10/msg00053.html
github.com/wernerd/ZRTPCPP/commit/4654f330317c9948bb61d138eb24d49690ca4637
blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html
secunia.com/advisories/54998
security.gentoo.org/glsa/glsa-201309-13.xml
Show 9 moreShow less
seclists.org/oss-sec/2013/q2/638
nvd.nist.gov/vuln/detail/CVE-2013-2223
ubuntu.com/security/CVE-2013-2223
cve.org/CVERecord?id=CVE-2013-2223
suse.com/security/cve/CVE-2013-2221