CVE-2013-2139
Estado: ModificadaBaja (2.6)—
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
- Puntuación base: 2.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.99%
- Percentil entre todas las CVEs puntuadas: 87
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-119
Referencias
- http://advisories.mageia.org/MGASA-2014-0465.html
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html
- http://lwn.net/Articles/579633/
- http://seclists.org/fulldisclosure/2013/Jun/10
- http://www.debian.org/security/2014/dsa-2840
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:219
- http://www.osvdb.org/93852
- https://bugzilla.redhat.com/show_bug.cgi?id=970697
- https://github.com/cisco/libsrtp/pull/27
- http://advisories.mageia.org/MGASA-2014-0465.html
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html
- http://lwn.net/Articles/579633/
- http://seclists.org/fulldisclosure/2013/Jun/10
- http://www.debian.org/security/2014/dsa-2840
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:219
- http://www.osvdb.org/93852
- https://bugzilla.redhat.com/show_bug.cgi?id=970697
- https://github.com/cisco/libsrtp/pull/27
JSON original (NVD)
Mostrar
{
"id": "CVE-2013-2139",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 2.6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "HIGH",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 4.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-01-16T05:05:23.947",
"references": [
{
"url": "http://advisories.mageia.org/MGASA-2014-0465.html",
"source": "secalert@redhat.com"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html",
"source": "secalert@redhat.com"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html",
"source": "secalert@redhat.com"
},
{
"url": "http://lwn.net/Articles/579633/",
"source": "secalert@redhat.com"
},
{
"url": "http://seclists.org/fulldisclosure/2013/Jun/10",
"source": "secalert@redhat.com"
},
{
"url": "http://www.debian.org/security/2014/dsa-2840",
"source": "secalert@redhat.com"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:219",
"source": "secalert@redhat.com"
},
{
"url": "http://www.osvdb.org/93852",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=970697",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/cisco/libsrtp/pull/27",
"source": "secalert@redhat.com"
},
{
"url": "http://advisories.mageia.org/MGASA-2014-0465.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lwn.net/Articles/579633/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2013/Jun/10",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2014/dsa-2840",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:219",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/93852",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=970697",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/cisco/libsrtp/pull/27",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions."
},
{
"lang": "es",
"value": "Desbordamiento de búfer en srtp.c en libsrtp en srtp 1.4.5 y anteriores permite a atacantes remotos provocar una denegación de servicio (caída) a través de vectores relacionados con una inconsistencia en la longitud de las funciones crypto_policy_set_from_profile_for_rtp y srtp_protect."
}
],
"lastModified": "2026-06-16T23:52:49.173",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E14271AE-1309-48F3-B9C6-D7DEEC488279"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5991814D-CA77-4C25-90D2-DB542B17E0AD"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:libsrtp:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0366C4E-3BB9-4213-AC34-E6468361CB30",
"versionEndIncluding": "1.4.5"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E0C77E7-FCE4-4F98-877C-4D42FE151922"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "788EFE4D-6D30-4441-81F3-FC175E093630"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4ADFEF4E-BA80-4EB0-92DB-24C12C796B5A"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABFA2003-55AB-41E7-92D6-CD311A9948E3"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56BA5BC7-1B3B-4390-A4AD-1914E924DE7C"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.3.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8278F0E-7562-4B03-B431-1FF8256C1602"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "162F62DE-8CD6-4677-B643-929D959480AB"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34931F97-C976-46BA-958F-DCF161952045"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FEA1CDFC-6D85-4596-ACEF-D43B59737454"
},
{
"criteria": "cpe:2.3:a:cisco:libsrtp:1.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CB51CAE-05B6-4542-B934-D94C381BC2B0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}