CVE-2013-6934

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.htmlExploit, Third Party Advisory
http://www.live555.com/liveMedia/public/changelog.txtVendor Advisory
http://www.securityfocus.com/bid/65139Third Party Advisory, VDB Entry
http://isecpartners.github.io/fuzzing/vulnerabilities/2013/12/30/vlc-vulnerability.htmlExploit, Third Party Advisory
http://www.live555.com/liveMedia/public/changelog.txtVendor Advisory
http://www.securityfocus.com/bid/65139Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-69359.3Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the S CVE-2013-69367.5Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote CVE-2013-69376.8Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the n CVE-2013-69385.0Unspecified vulnerability in the Service VM in Citrix NetScaler SDX 9.3 before 9.3-64.4 and 10.0 before 10.0-77.5 and Application Delivery C CVE-2013-69395.0Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 b CVE-2013-69405.0Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 logs user cr CVE-2013-694110.0Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 b CVE-2013-69426.8Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before CVE-2013-69435.0Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remot CVE-2013-69444.3Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (AD CVE-2013-69457.5The M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to bypass authentication and authorization to per CVE-2013-69487.8The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML doc