CVE-2013-2223
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized...
CVE-2013-2223 is a medium vulnerability (CVSS 5.8) in Wernerd Zrtpcpp, published October 4, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. No source names a fixed version.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 3.21%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
Exploit likelihood
Affected products
What each source reports
NVD Score used
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
CVE-2013-2223- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
CVE-2013-2223- Updated
- 2026-11-02
EUVDEUVD-2013-2176No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
EUVD-2013-2176- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjxq-qhvw-jj4xNo score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized...
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
GHSA-xjxq-qhvw-jj4x- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10304-1No score
libzrtpcpp-devel-4.6.4-1.1 on GA media
These are all security issues fixed in the libzrtpcpp-devel-4.6.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10304-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2223No score
GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet, as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.
- Record
UBUNTU-CVE-2013-2223- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2013-10/msg00053.html
github.com/wernerd/ZRTPCPP/commit/4654f330317c9948bb61d138eb24d49690ca4637
blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html
secunia.com/advisories/54998
security.gentoo.org/glsa/glsa-201309-13.xml
Show 9 moreShow less
seclists.org/oss-sec/2013/q2/638
nvd.nist.gov/vuln/detail/CVE-2013-2223
ubuntu.com/security/CVE-2013-2223
cve.org/CVERecord?id=CVE-2013-2223
suse.com/security/cve/CVE-2013-2221