Description
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Live Networks | LIVE555 Media Server | Version 0.92 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | liblivemedia | 2018.10.17-1 | — |
| Debian 9 | liblivemedia | 2016.11.28-1+deb9u1 | DSA-4343-1 |
| Debian 8 | liblivemedia | 2014.01.13-1+deb8u1 | DLA-1582-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | liblivemedia | 2014.01.13-1+deb8u1build0.14.04.1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | liblivemedia | 2018.02.18-1ubuntu0.1~esm1 | USN-4853-1 |
| Ubuntu Pro 16.04 LTS | liblivemedia | 2016.02.09-1ubuntu0.1~esm1 | USN-4853-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 | live555 | 2018.12.14-bp150.3.3.1 | openSUSE-SU-2019:0058-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | live555 | 2018.12.14-bp150.3.3.1 | openSUSE-SU-2019:0058-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
r3dxpl0it/RTSPServer-Code-Execution-Vulnerability ★ 15 · Nov 24, 2018
RTSPServer Code Execution Vulnerability CVE-2018-4013
-
DoubleMice/cve-2018-4013 ★ 6 · Oct 24, 2018
TALOS-2018-0684/cve-2018-4013 poc
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- USN-4853-1 liblivemedia vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4343-1 liblivemedia - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1582-1 liblivemedia - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:0058-1 Security update for live555 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-4343 vendor-advisory
- [live-devel] 20181017 New LIVE555 version - fixes a potential vulnerability in the RTSP server implementation mailing-list
- [debian-lts-announce] 20181120 [SECURITY] [DLA 1582-1] liblivemedia security update mailing-list
- GLSA-202005-06 vendor-advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684