{"id":"CVE-2013-6933","aliases":["DEBIAN-CVE-2013-6933","DSA-3156-1","EUVD-2013-6734","GHSA-vcpq-3936-w8vf","UBUNTU-CVE-2013-6933"],"status":"published","title":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.17415,"percentile":0.97141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-189"],"published":"2014-01-23T21:00:00Z","modified":"2026-10-05T04:00:03Z","fixes":[{"ecosystem":"Debian:14","package":"liblivemedia","fixed_in":["2014.01.13-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mplayer","fixed_in":["2:1.1.1+svn37434-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mplayer","fixed_in":["2:1.1.1+svn37434-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mplayer","fixed_in":["2:1.1.1+svn37434-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vlc","fixed_in":["2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"liblivemedia","fixed_in":["2012.05.17-1+wheezy1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"vlc","fixed_in":["2.0.3-5+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mplayer","fixed_in":["2:1.0~rc4.dfsg1+svn34540-1+deb7u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.01.13-1"}]}],"versions":["2004.11.11a-1","2005.04.01-1","2005.06.16-1","2005.07.21-1","2005.10.05-1","2006.03.17-1","2006.03.17-2","2007.02.20-1","2007.02.20-2","2008.07.25-1","2008.07.25-2","2009.11.27-1","2010.02.10-1","2010.04.09-1","2010.11.17-1","2011.03.14-1","2011.05.25-1","2011.06.16-1","2011.07.08-1","2011.07.21-1","2011.08.22-1","2011.09.02-1","2011.12.23-1","2012.02.04-1","2012.02.29-1","2012.02.29-2","2012.04.04-1","2012.04.21-1","2012.05.03-1","2012.05.03-1~bpo60+1","2012.05.17-1","2012.05.17-1+wheezy1","2012.05.17-1~bpo60+1","2012.08.31-1","2012.10.24-1","2012.11.16-1","2012.11.30-1","2013.01.05-1","2013.01.05-2","2013.01.05-3","2013.01.15-1","2013.04.30-1","2013.10.25-1"]},{"source":"osv","ecosystem":"Debian:12","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.1+svn37434-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.1+svn37434-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.1+svn37434-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.05.17-1+wheezy1"}]}],"versions":["2012.05.17-1"]},{"source":"osv","ecosystem":"Debian:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-5+deb7u2"}]}],"versions":["2.0.3-5","2.0.3-5+deb7u1"]},{"source":"osv","ecosystem":"Debian:7","package":"mplayer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0~rc4.dfsg1+svn34540-1+deb7u1"}]}],"versions":["2:1.0~rc4.dfsg1+svn34540-1"]}],"products":[{"vendor":"live555","product":"streaming_media"}],"references":[{"url":"http://www.live555.com/liveMedia/public/changelog.txt","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.html","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6933"},{"url":"https://github.com/advisories/GHSA-vcpq-3936-w8vf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6933","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-6933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6933","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-6933","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2014-01-23T21:00:00Z","modified":"2024-08-06T17:53:45.948Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6734","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2014-01-23T21:00:00Z","modified":"2024-08-06T17:53:45Z","updated_at":"2026-11-03T01:56:24.812586Z"}],"ghsa":[{"id":"GHSA-vcpq-3936-w8vf","title":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through...","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2022-05-13T01:54:14Z","modified":"2023-02-02T05:02:18Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:24.429027Z"}],"nvd":[{"id":"CVE-2013-6933","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2014-01-23T21:55:04.913Z","modified":"2026-06-17T00:01:09.153Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119","CWE-189"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-6933","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2014-01-23T21:55:04Z","modified":"2026-04-10T03:43:25.692539Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6933","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"published","published":"2014-01-23T21:55:04.913Z","modified":"2026-10-05T04:00:03.792631181Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-3156-1","title":"liblivemedia - security update","status":"published","published":"2015-02-07T00:00:00Z","modified":"2026-03-09T01:21:45.379139Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"UBUNTU-CVE-2013-6933","description":"The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.","status":"withdrawn","published":"2014-01-23T21:55:00Z","modified":"2025-07-16T06:46:55.568182Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}