Read the docs
TI-2004-00397 Aliases CVE-2004-0433GHSA-4pvm-mp59-j2rf

Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1)…

Priority MEDIUM 51Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.

Why it matters now

EPSS 0.05116 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:mplayer:mplayer:1.0_pre3try2:*:*:*:*:*:*:*1.0_pre3try2VulnerableMplayer
cpe:2.3:a:xine:xine-lib:1_beta1:*:*:*:*:*:*:*1_beta1VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta2:*:*:*:*:*:*:*1_beta2VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta3:*:*:*:*:*:*:*1_beta3VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta4:*:*:*:*:*:*:*1_beta4VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta5:*:*:*:*:*:*:*1_beta5VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta6:*:*:*:*:*:*:*1_beta6VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta7:*:*:*:*:*:*:*1_beta7VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta8:*:*:*:*:*:*:*1_beta8VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta9:*:*:*:*:*:*:*1_beta9VulnerableXine
  • cpe:2.3:a:mplayer:mplayer:1.0_pre3try2:*:*:*:*:*:*:* Versions 1.0_pre3try2 Vulnerable ·Mplayer
  • cpe:2.3:a:xine:xine-lib:1_beta1:*:*:*:*:*:*:* Versions 1_beta1 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta2:*:*:*:*:*:*:* Versions 1_beta2 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta3:*:*:*:*:*:*:* Versions 1_beta3 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta4:*:*:*:*:*:*:* Versions 1_beta4 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta5:*:*:*:*:*:*:* Versions 1_beta5 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta6:*:*:*:*:*:*:* Versions 1_beta6 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta7:*:*:*:*:*:*:* Versions 1_beta7 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta8:*:*:*:*:*:*:* Versions 1_beta8 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta9:*:*:*:*:*:*:* Versions 1_beta9 Vulnerable ·Xine
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xine:xine-lib:1_beta10:*:*:*:*:*:*:*1_beta10VulnerableXine
cpe:2.3:a:xine:xine-lib:1_beta11:*:*:*:*:*:*:*1_beta11VulnerableXine
cpe:2.3:a:xine:xine-lib:1_rc2:*:*:*:*:*:*:*1_rc2VulnerableXine
cpe:2.3:a:xine:xine-lib:1_rc3a:*:*:*:*:*:*:*1_rc3aVulnerableXine
cpe:2.3:a:xine:xine-lib:1_rc3b:*:*:*:*:*:*:*1_rc3bVulnerableXine
cpe:2.3:a:xine:xine-lib:1_rc3c:*:*:*:*:*:*:*1_rc3cVulnerableXine
  • cpe:2.3:a:xine:xine-lib:1_beta10:*:*:*:*:*:*:* Versions 1_beta10 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_beta11:*:*:*:*:*:*:* Versions 1_beta11 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_rc2:*:*:*:*:*:*:* Versions 1_rc2 Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_rc3a:*:*:*:*:*:*:* Versions 1_rc3a Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_rc3b:*:*:*:*:*:*:* Versions 1_rc3b Vulnerable ·Xine
  • cpe:2.3:a:xine:xine-lib:1_rc3c:*:*:*:*:*:*:* Versions 1_rc3c Vulnerable ·Xine

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-0433
  2. 2026-10-03 Alias added: GHSA-4pvm-mp59-j2rf

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences