CVE-2013-6934: Buffer Overflow
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6934?
CVE-2013-6934 is considered to have a high severity due to its potential to cause a denial of service and possibly allow remote code execution.
How do I fix CVE-2013-6934?
To fix CVE-2013-6934, upgrade to Live555 Streaming Media version 2013-11-27 or later and ensure VLC Media Player is updated to version 2.1.0 or newer.
What type of attack does CVE-2013-6934 enable?
CVE-2013-6934 enables remote attackers to send specially crafted RTSP messages that can crash the application or potentially execute arbitrary code.
Which software applications are affected by CVE-2013-6934?
CVE-2013-6934 affects Live555 Streaming Media version 2013-11-26 and VLC Media Player versions prior to 2.1.0.
Is CVE-2013-6934 a known vulnerability?
Yes, CVE-2013-6934 is a known vulnerability that has been documented in security advisories related to the affected software.