CVE-2004-0433
Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash)…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 5.12% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- mplayer/mplayer · xine/xine-lib
- Source
- cve@mitre.org
References
- http://security.gentoo.org/glsa/glsa-200405-24.xmlVendor Advisory
- http://www.xinehq.de/index.php/security/XSA-2004-3
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16019
- http://security.gentoo.org/glsa/glsa-200405-24.xmlVendor Advisory
- http://www.xinehq.de/index.php/security/XSA-2004-3
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16019
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.