CVE-2020-14033

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_streaming_rtsp_parse_sdp in plugins/janus_streaming.c has a Buffer Overflow via a crafted RTSP server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6117Patch, Third Party Advisory
https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6166Patch, Third Party Advisory
https://github.com/meetecho/janus-gateway/pull/2229Third Party Advisory
https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6117Patch, Third Party Advisory
https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6166Patch, Third Party Advisory
https://github.com/meetecho/janus-gateway/pull/2229Third Party Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-140349.8An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_get_codec_from_pt in utils.c has a Buffer Overflow CVE-2020-140395.3In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if Verif CVE-2020-14047.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation CVE-2020-140407.5The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite lo CVE-2020-140426.1** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability CVE-2020-140438.8** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The reques CVE-2020-140447.2** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user wi CVE-2020-140487.5Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of depl CVE-2020-140497.5Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary para CVE-2020-14057.1An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Wi CVE-2020-140549.8SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to b CVE-2020-140556.1Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encodi