Unscored severity · published Jan 16, 2014
CVE-2013-2139
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the…
–
CVSS
3%
EPSS
No
On KEV
Description
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
18; 19; 20 · source: NVD
LI
Libsrtp · Cisco
through 1.4.5; 1.0.1; 1.0.2; 1.0.4; 1.0.5; 1.0.6; +5 more · source: NVD
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2139
advisories.mageia.org
http://advisories.mageia.org/MGASA-2014-0465.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html
lwn.net
http://lwn.net/Articles/579633/
seclists.org
http://seclists.org/fulldisclosure/2013/Jun/10
www.debian.org
http://www.debian.org/security/2014/dsa-2840
More from Libsrtp
7.5
CVE-2015-6360
The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686