CVE-2013-2139: Cisco Libsrtp

Low severity, CVSS 2.6. EPSS: 3% chance of exploitation in the next 30 days.

Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.

Affected products

• Cisco Libsrtp: up to and including 1.4.5; version 1.0.1 only; version 1.0.2 only; version 1.0.4 only; version 1.0.5 only; version 1.0.6 only; …
• Fedoraproject Fedora: version 18 only; version 19 only; version 20 only
• Opensuse Opensuse: version 12.3 only; version 13.1 only

Published 2014-01-16. Last modified 2026-06-16.