CVE-2013-4388
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media...
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
CVE-2013-4388- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
CVE-2013-4388- Updated
- 2026-11-02
EUVDEUVD-2013-4269 No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
EUVD-2013-4269- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h8jp-pg37-w2ww No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media...
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
GHSA-h8jp-pg37-w2ww- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
CVE-2013-4388- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4388 No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
DEBIAN-CVE-2013-4388- Updated
- 2026-11-02
OSVMGASA-2014-0296 No score
Updated live555, vlc & mplayer packages fix several issues
Updated live, mplayer, and vlc packages fix security vulnerabilities:
The live555 RTSP streaming server and client libraries before 2013.11.29 are vulnerable to buffer overflows in RTSP command parsing that potentially allow for arbitrary code execution when connected to a malicious client or server.
The RTSP client streaming code in the mplayer and vlc packages is built from the live555 code in the live package. They have been rebuilt with the updated live packages.
The vlc packages have also been updated to 2.0.10 for Mageia 3 and 2.1.5 for Mageia 4, fixing several other bugs and potential security issues. The Mageia 3 update fixes a buffer overflow in the mp4a packetizer (CVE-2013-4388) that was fixed upstream in 2.0.9.
Finally, the mplayer update for Mageia 3 includes two upstream patches; one disables playlist parsing for security reasons and the other fixes mp3 decoding cutting out early (mga#10478).
- Record
MGASA-2014-0296- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4388 No score
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
- Record
UBUNTU-CVE-2013-4388- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 2.1.0-1 | 2.1.0-1 |
vlcDebian:13 |
before 2.1.0-1 | 2.1.0-1 |
vlcDebian:14 |
before 2.1.0-1 | 2.1.0-1 |
vlcDebian:7 From an advisory covering 3 CVEs |
before 2.0.3-5+deb7u1, plus listed versions 2.0.3-5 |
2.0.3-5+deb7u1 |
liveMageia:3 |
before 2014.07.04-1.mga3 | 2014.07.04-1.mga3 |
vlcMageia:3 |
before 2.0.10-1.mga3 | 2.0.10-1.mga3 |
mplayerMageia:3 |
before 1.1-13.r35916.3.mga3 | 1.1-13.r35916.3.mga3 |
vlcMageia:3 |
before 2.0.10-1.mga3.tainted | 2.0.10-1.mga3.tainted |
mplayerMageia:3 |
before 1.1-13.r35916.3.mga3.tainted | 1.1-13.r35916.3.mga3.tainted |
liveMageia:4 |
before 2014.07.04-1.mga4 | 2014.07.04-1.mga4 |
Show 4 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4388 is a medium vulnerability (CVSS 6.8) in Videolan Vlc Media Player, published October 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.78%, the 90th percentile. Fixed in vlc 2.1.0-1.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18086
secunia.com/advisories/59793
videolan.org/developers/vlc-branch/NEWS
securityfocus.com/bid/62724
openwall.com/lists/oss-security/2013/10/01/2
securitytracker.com/id/1029120
Show 13 moreShow less
git.videolan.org?p=vlc.git%3Ba=commitdiff%3Bh=9794ec1cd268c04c8bca13a5fae15df6594dff3e
nvd.nist.gov/vuln/detail/CVE-2013-4388
github.com/advisories/GHSA-h8jp-pg37-w2ww
security-tracker.debian.org/tracker/CVE-2013-4388
advisories.mageia.org/MGASA-2014-0296.html
live555.com/liveMedia/public/changelog.txt
lists.mplayerhq.hu/pipermail/mplayer-announce/2013-May/000070.html
debian.org/security/2014/dsa-2973
bugs.mageia.org/show_bug.cgi?id=10478
ubuntu.com/security/CVE-2013-4388
cve.org/CVERecord?id=CVE-2013-4388