CVE-2013-6933
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...
CVE-2013-6933 is a high vulnerability (CVSS 7.5) in Live555 Streaming Media, published January 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 17.4%, the 97th percentile. Fixed in liblivemedia 2014.01.13-1.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 17.4%EPSS, 97th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2014.01.13-1liblivemedia +9 more
Description
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
liblivemediaDebian:14 | before 2014.01.13-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 38 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-1 | 2014.01.13-1 |
mplayerDebian:12 | before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
mplayerDebian:13 | before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
mplayerDebian:14 | before 2:1.1.1+svn37434-1 | 2:1.1.1+svn37434-1 |
vlcDebian:12 | before 2.1.4-1 | 2.1.4-1 |
vlcDebian:13 | before 2.1.4-1 | 2.1.4-1 |
vlcDebian:14 | before 2.1.4-1 | 2.1.4-1 |
liblivemediaDebian:7 | before 2012.05.17-1+wheezy1, plus listed versions 2012.05.17-1 | 2012.05.17-1+wheezy1 |
vlcDebian:7 | before 2.0.3-5+deb7u2, plus listed versions 2.0.3-52.0.3-5+deb7u1 | 2.0.3-5+deb7u2 |
mplayerDebian:7 | before 2:1.0~rc4.dfsg1+svn34540-1+deb7u1, plus listed versions 2:1.0~rc4.dfsg1+svn34540-1 | 2:1.0~rc4.dfsg1+svn34540-1+deb7u1 |
What each source reports
NVD Score used
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-189
- Updated
- 2026-11-02
CVE ListNo score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- Updated
- 2026-11-02
EUVDEUVD-2013-6734No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
EUVD-2013-6734- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcpq-3936-w8vfNo score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
GHSA-vcpq-3936-w8vf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
CVE-2013-6933- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6933No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
DEBIAN-CVE-2013-6933- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6933No score
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.
- Record
UBUNTU-CVE-2013-6933- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
live555.com/liveMedia/public/changelog.txt
isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.html
nvd.nist.gov/vuln/detail/CVE-2013-6933
github.com/advisories/GHSA-vcpq-3936-w8vf
security-tracker.debian.org/tracker/CVE-2013-6933
ubuntu.com/security/CVE-2013-6933
cve.org/CVERecord?id=CVE-2013-6933