Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 10 DLA-3091-1 Moderate: Sofia-SIP Out-Of-Bounds Issues

debian lts
Calendar Grey September 2, 2022
Dist Debian Esm H88
Enhance the sofia-sip library to mitigate vulnerabilities associated with CVE-2022-31001 and similar concerns, thereby bolstering overall security measures.
The following vulnerabilities have been discovered in the sofia-sip, a SIP user-agent library
Topics%20covered

Topics Covered

security advisory moderate remote code execution debian out-of-bounds crash sofia-sip

Summary

CVE-2022-31001

An attacker can send a message with evil sdp to FreeSWITCH, which
will make `n` bigger and trigger out-of-bound access and may cause
crash

CVE-2022-31002

An attacker can send a message with evil sdp to FreeSWITCH, which
may cause crash.This type of crash is caused by url ending with %,
the craft message looks like this.

CVE-2022-31003

When parsing each line of a sdp message, `rest = record + 2` will
access the memory behind `\0` and cause an out-of-bounds write.
An attacker can send a message with evil sdp to FreeSWITCH,
causing a crash or more serious consequence, such as remote code
execution.

For Debian 10 buster, these problems have been fixed in version
1.12.11+20110422.1-2.1+deb10u1.

We recommend that you upgrade your sofia-sip packages.

For the detailed security status of sofia-sip please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/sofia-sip

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Package: sofia-sip
Version: 1.12.11+20110422.1-2.1+deb10u1
CVE ID: CVE-2022-31001 CVE-2022-31002 CVE-2022-31003

Topics%20covered

Topics Covered

security advisory moderate remote code execution debian out-of-bounds crash sofia-sip

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here