CVE-2018-4013

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

Score

CVSS 3.0 10.0 Critical

Status

Modified - talos-cna@cisco.com

Published

2018-10-19

Last modified

2024-09-16

Weaknesses

CWE-121, CWE-787

Affected products

• Debian Linux (Debian)
• Live555 Media Server (Live555)
• Live555 Media Server (Live Networks)

References

• http://lists.live555.com/pipermail/live-devel/2018-October/021071.html
• https://lists.debian.org/debian-lts-announce/2018/11/msg00020.html
• https://security.gentoo.org/glsa/202005-06
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684
• https://www.debian.org/security/2018/dsa-4343