CVE-2013-2139
Fixed in a distro release EPSS 3%
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
Products: fedoraproject fedora, opensuse, cisco libsrtp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libsrtp | 1.4.4-11.20101004cvs.amzn2 |
| Amazon Linux 2 | libsrtp-devel | 1.4.4-11.20101004cvs.amzn2 |
| Debian 6.0 | srtp | 1.4.4~dfsg-6+deb6u1 |
| Debian 7 | srtp | 1.4.4+20100615~dfsg-2+deb7u1 |
| Red Hat Enterprise Linux 7 | libsrtp | 0:1.4.4-11.20101004cvs.el7 |
| Red Hat Enterprise Linux 7 | libsrtp-debuginfo | 0:1.4.4-11.20101004cvs.el7 |
| Red Hat Enterprise Linux 7 | libsrtp-devel | 0:1.4.4-11.20101004cvs.el7 |
| openSUSE Tumbleweed | libsrtp | 1.5.4-2.1 |
| openSUSE Tumbleweed | libsrtp | 2.4.1-1.2 |