Missing message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow (CVE-2023-22741) References: - https://bugs.mageia.org/show_bug.cgi?id=31493 . MGASA-2023-0040 - Updated sofia-sip packages fix security vulnerability Publication date: 07 Feb 2023 URL: https://advisories.mageia.org/MGASA-2023-0040.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-22741 Missing message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow (CVE-2023-22741) References: - https://bugs.mageia.org/show_bug.cgi?id=31493 - https://lists.debian.org/debian-lts-announce/2023/01/msg00032.html - https://www.cve.org/CVERecord?id=CVE-2023-22741 SRPMS: - 8/core/sofia-sip-1.12.11-10.2.mga8 . Mageia 2023-0041 patches address buffer overflow in libp2p stemming from missing ICE candidate validation, with crucial information included.. sofia-sip security update,mageia threat fix,heap overflow mitigation. . Severity: Critical. LinuxSecurity.com Team
Colin Cuthbertson and Walter Doekes discovered two vulnerabilities in the SIP processing code of Asterisk - an open source PBX and telephony toolkit -, which could result in denial of service. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2749-1
Get the latest Linux and open source security news straight to your inbox.