{"api_version":"1","generated_at":"2026-07-23T01:12:24+00:00","cve":"CVE-2013-2139","urls":{"html":"https://cve.report/CVE-2013-2139","api":"https://cve.report/api/cve/CVE-2013-2139.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-2139","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-2139"},"summary":{"title":"CVE-2013-2139","description":"Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-01-16 05:05:23","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:N/A:P","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://lwn.net/Articles/579633/","name":"http://lwn.net/Articles/579633/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fedora alert FEDORA-2013-24153 (libsrtp) [LWN.net]","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2013/Jun/10","name":"http://seclists.org/fulldisclosure/2013/Jun/10","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: [GTA-2013-01] - Libsrtp srtp_protect/hmac_compute\tbuffer overflow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html","name":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2014:1250-1: moderate: srtp","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/cisco/libsrtp/pull/27","name":"https://github.com/cisco/libsrtp/pull/27","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Docupdate by jfigus · Pull Request #27 · cisco/libsrtp · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:219","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:219","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support / Security / Advisories /  / MDVSA-2014:219 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2014/dsa-2840","name":"http://www.debian.org/security/2014/dsa-2840","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-2840-1 srtp","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970697","name":"https://bugzilla.redhat.com/show_bug.cgi?id=970697","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"970697 – (CVE-2013-2139) CVE-2013-2139 libsrtp: buffer overflow in application of crypto profiles","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/93852","name":"http://www.osvdb.org/93852","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://advisories.mageia.org/MGASA-2014-0465.html","name":"http://advisories.mageia.org/MGASA-2014-0465.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mageia Advisory: MGASA-2014-0465 - Updated srtp package fixes security vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html","name":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2013:1258-1: moderate: srtp","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2139","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2139","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.3.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"1.4.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"1.4.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"libsrtp","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"18","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"19","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"opensuse","cpe5":"opensuse","cpe6":"12.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2139","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"opensuse","cpe5":"opensuse","cpe6":"13.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2013","cve_id":"2139","cve":"CVE-2013-2139","epss":"0.018070000","percentile":"0.829120000","score_date":"2026-05-03","updated_at":"2026-05-04 00:13:06"},"legacy_qids":[{"cve":"CVE-2013-2139","qid":"377499","title":"Alibaba Cloud Linux Security Update for libsrtp (ALINUX2-SA-2020:0125)"},{"cve":"CVE-2013-2139","qid":"671055","title":"EulerOS Security Update for libsrtp (EulerOS-SA-2019-2617)"},{"cve":"CVE-2013-2139","qid":"671111","title":"EulerOS Security Update for libsrtp (EulerOS-SA-2019-2706)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T15:27:40.955Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"MDVSA-2014:219","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:219"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970697"},{"name":"20130603 [GTA-2013-01] - Libsrtp srtp_protect/hmac_compute\tbuffer overflow","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2013/Jun/10"},{"name":"FEDORA-2013-24153","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lwn.net/Articles/579633/"},{"name":"DSA-2840","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2014/dsa-2840"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/cisco/libsrtp/pull/27"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://advisories.mageia.org/MGASA-2014-0465.html"},{"name":"93852","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/93852"},{"name":"openSUSE-SU-2014:1250","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html"},{"name":"openSUSE-SU-2013:1258","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-06-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-03-24T17:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"MDVSA-2014:219","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:219"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970697"},{"name":"20130603 [GTA-2013-01] - Libsrtp srtp_protect/hmac_compute\tbuffer overflow","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2013/Jun/10"},{"name":"FEDORA-2013-24153","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lwn.net/Articles/579633/"},{"name":"DSA-2840","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2014/dsa-2840"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/cisco/libsrtp/pull/27"},{"tags":["x_refsource_CONFIRM"],"url":"http://advisories.mageia.org/MGASA-2014-0465.html"},{"name":"93852","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/93852"},{"name":"openSUSE-SU-2014:1250","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html"},{"name":"openSUSE-SU-2013:1258","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-2139","datePublished":"2014-01-16T02:00:00.000Z","dateReserved":"2013-02-19T00:00:00.000Z","dateUpdated":"2024-08-06T15:27:40.955Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-01-16 05:05:23","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:N/A:P","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*","matchCriteriaId":"E14271AE-1309-48F3-B9C6-D7DEEC488279"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*","matchCriteriaId":"5991814D-CA77-4C25-90D2-DB542B17E0AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*","matchCriteriaId":"FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*","matchCriteriaId":"DFBF430B-0832-44B0-AA0E-BA9E467F7668"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*","matchCriteriaId":"A10BC294-9196-425F-9FB0-B1625465B47F"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.5","matchCriteriaId":"C0366C4E-3BB9-4213-AC34-E6468361CB30"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"1E0C77E7-FCE4-4F98-877C-4D42FE151922"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"788EFE4D-6D30-4441-81F3-FC175E093630"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"4ADFEF4E-BA80-4EB0-92DB-24C12C796B5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"ABFA2003-55AB-41E7-92D6-CD311A9948E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"56BA5BC7-1B3B-4390-A4AD-1914E924DE7C"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.3.20:*:*:*:*:*:*:*","matchCriteriaId":"F8278F0E-7562-4B03-B431-1FF8256C1602"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"162F62DE-8CD6-4677-B643-929D959480AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.4.1:*:*:*:*:*:*:*","matchCriteriaId":"34931F97-C976-46BA-958F-DCF161952045"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.4.2:*:*:*:*:*:*:*","matchCriteriaId":"FEA1CDFC-6D85-4596-ACEF-D43B59737454"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:libsrtp:1.4.4:*:*:*:*:*:*:*","matchCriteriaId":"5CB51CAE-05B6-4542-B934-D94C381BC2B0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"2139","Ordinal":"1","Title":"CVE-2013-2139","CVE":"CVE-2013-2139","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"2139","Ordinal":"1","NoteData":"Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.","Type":"Description","Title":"CVE-2013-2139"},{"CveYear":"2013","CveId":"2139","Ordinal":"2","NoteData":"2014-01-15","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"2139","Ordinal":"3","NoteData":"2015-03-24","Type":"Other","Title":"Modified"}]}}}