CVE-2004-0433: Buffer Overflow

Published May 5, 2004

Updated

Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.

Affected Software

16 affected components

MPlayer MPlayer=1.0_pre3try2

xine Xine-lib=1_beta1

xine Xine-lib=1_beta2

xine Xine-lib=1_beta3

xine Xine-lib=1_beta4

xine Xine-lib=1_beta5

xine Xine-lib=1_beta6

xine Xine-lib=1_beta7

xine Xine-lib=1_beta8

xine Xine-lib=1_beta9

xine Xine-lib=1_beta10

xine Xine-lib=1_beta11

xine Xine-lib=1_rc2

xine Xine-lib=1_rc3a

xine Xine-lib=1_rc3b

xine Xine-lib=1_rc3c

Event History

May 5, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0433?

CVE-2004-0433 is considered a moderate severity vulnerability due to the potential for denial of service and arbitrary code execution.

How do I fix CVE-2004-0433?

To remediate CVE-2004-0433, upgrade to MPlayer version 1.0pre4 or later and xine-lib version 1-rc4 or later.

Which software is affected by CVE-2004-0433?

CVE-2004-0433 affects MPlayer versions before 1.0pre4 and xine-lib versions before 1-rc4.

What type of vulnerability is CVE-2004-0433?

CVE-2004-0433 is characterized as a buffer overflow vulnerability.

Can CVE-2004-0433 lead to remote attacks?

Yes, CVE-2004-0433 can be exploited by remote attackers to crash the application or potentially execute arbitrary code.