Published: 19/02/2020 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
coturn project coturn 4.5.1.1
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 9.0
debian debian linux 10.0
canonical ubuntu linux 18.04
canonical ubuntu linux 19.10
canonical ubuntu linux 20.04
canonical ubuntu linux 16.04

Debian Bug report logs - #951876 coturn: CVE-2020-6061 CVE-2020-6062 Package: src:coturn; Maintainer for src:coturn is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 22 Feb 2020 15:54:02 UTC Severity: important Tags: security, upstream ...

Several vulnerabilities were discovered in coturn, a TURN and STUN server for VoIP CVE-2020-4067 Felix Doerre reported that the STUN response buffer was not properly initialised, which could allow an attacker to leak bytes in the padding bytes from the connection of another client CVE-2020-6061 Aleksandar Nikolic reported that a ...

CWE-125 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0984 https://www.debian.org/security/2020/dsa-4711 https://usn.ubuntu.com/4415-1/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQZZPI34LAS3SFNW6Z2ZJ46RKVGEODNA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2NK6FT7AMW5UIZNXDNHKEAYWAUMGSF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUVZRXW5ZIGWVKOLF3NPXRPP74YX7BUY/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=951876 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4711

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-6061

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect