CVE-2013-6934 Integer overflow in n/a
Remote attackers can cause denial of service or execute arbitrary code via a crafted RTSP message triggering an integer underflow in the Live555 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-6934?
CVE-2013-6934 is a high-severity vulnerability in Videolan Vlc Media Player, published on 23 Jan 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
Weakness: CWE-189
Which versions are affected by CVE-2013-6934?
It affects 2 products.
Products include Live555 Streaming Media, Videolan Vlc Media Player.
How do I fix CVE-2013-6934?
No fix has been published for CVE-2013-6934 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-6934 being exploited?
There is no known exploitation of CVE-2013-6934 in the wild and no public exploit code.
Other vulnerabilities in Videolan Vlc Media Player
Sources
Also known as GHSA-qqf2-v78c-75h2.