CVE-2013-6933
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-189
- Updated
- 2026-11-02
CVE List No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- Updated
- 2026-11-02
EUVDEUVD-2013-6734 No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
EUVD-2013-6734- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcpq-3936-w8vf No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
GHSA-vcpq-3936-w8vf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6933 No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
DEBIAN-CVE-2013-6933- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6933 No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
UBUNTU-CVE-2013-6933- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
liblivemediaDebian:14 |
before 2014.01.13-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 38 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-1 |
2014.01.13-1 |
mplayerDebian:12 |
before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
mplayerDebian:13 |
before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
mplayerDebian:14 |
before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
vlcDebian:12 |
before 2.1.4-1 | 2.1.4-1 |
vlcDebian:13 |
before 2.1.4-1 | 2.1.4-1 |
vlcDebian:14 |
before 2.1.4-1 | 2.1.4-1 |
liblivemediaDebian:7 |
before 2012.05.17-1+wheezy1, plus listed versions 2012.05.17-1 |
2012.05.17-1+wheezy1 |
vlcDebian:7 |
before 2.0.3-5+deb7u2, plus listed versions 2.0.3-52.0.3-5+deb7u1 |
2.0.3-5+deb7u2 |
mplayerDebian:7 |
before 2:1.0~rc4.dfsg1+svn34540-1+deb7u1, plus listed versions 2:1.0~rc4.dfsg1+svn34540-1 |
2:1.0~rc4.dfsg1+svn34540-1+deb7u1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6933 is a high vulnerability (CVSS 7.5) in Live555 Streaming Media, published January 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 17.4%, the 97th percentile. Fixed in liblivemedia 2014.01.13-1.
References
live555.com/liveMedia/public/changelog.txt
isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.html
nvd.nist.gov/vuln/detail/CVE-2013-6933
github.com/advisories/GHSA-vcpq-3936-w8vf
security-tracker.debian.org/tracker/CVE-2013-6933
ubuntu.com/security/CVE-2013-6933
cve.org/CVERecord?id=CVE-2013-6933