Librtmp
Monthly
Heap out-of-bounds read in librtmp (RTMPDump) through 2.6 can crash RTMP clients when AMFProp_Decode parses an AMF0 strict-array element count without first confirming that four bytes remain. The issue is unauthenticated from the network perspective but requires the victim to initiate an RTMP session with an attacker-controlled server or for an attacker to be positioned as a man-in-the-middle; impact is limited to availability (client crash), with no code execution or confidentiality impact established. No public exploit code was identified at time of analysis.
Out-of-bounds heap reads, and under a non-default configuration out-of-bounds heap writes, in librtmp as shipped with RTMPDump through 2.6 let an unauthenticated attacker who controls or intercepts an RTMP server corrupt or leak memory inside the connecting client. AMF3_Decode ignores failures returned by the AMF3 property decoder, so an oversized AMF3 string length supplied by the server is trusted and used against buffers it does not actually describe, producing an over-read of heap bytes; the write primitive is only reached when the client is invoked with the --token option that enables the DecodeTEA path. Scored 6.1, with no public exploit identified at time of analysis, and real exposure confined to hosts that actively act as RTMP clients against attacker-reachable servers.
Heap out-of-bounds read in librtmp (RTMPDump) through 2.6 can crash RTMP clients when AMFProp_Decode parses an AMF0 strict-array element count without first confirming that four bytes remain. The issue is unauthenticated from the network perspective but requires the victim to initiate an RTMP session with an attacker-controlled server or for an attacker to be positioned as a man-in-the-middle; impact is limited to availability (client crash), with no code execution or confidentiality impact established. No public exploit code was identified at time of analysis.
Out-of-bounds heap reads, and under a non-default configuration out-of-bounds heap writes, in librtmp as shipped with RTMPDump through 2.6 let an unauthenticated attacker who controls or intercepts an RTMP server corrupt or leak memory inside the connecting client. AMF3_Decode ignores failures returned by the AMF3 property decoder, so an oversized AMF3 string length supplied by the server is trusted and used against buffers it does not actually describe, producing an over-read of heap bytes; the write primitive is only reached when the client is invoked with the --token option that enables the DecodeTEA path. Scored 6.1, with no public exploit identified at time of analysis, and real exposure confined to hosts that actively act as RTMP clients against attacker-reachable servers.