Published: 31/05/2022 Updated: 24/05/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
signalwire sofia-sip
debian debian linux 10.0

Debian Bug report logs - #1016974 sofia-sip: CVE-2022-31001 CVE-2022-31002 CVE-2022-31003 Package: src:sofia-sip; Maintainer for src:sofia-sip is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Wed, 10 Aug 2022 20:09:04 UTC Severity: grave Tags: ...

Multiple security issues were discovered in Sofia-SIP, a SIP User-Agent library, which could result in denial of service For the stable distribution (bullseye), these problems have been fixed in version 11211+201104221-21+deb11u1 We recommend that you upgrade your sofia-sip packages For the detailed security status of sofia-sip please refer ...

CWE-787 CWE-122 https://github.com/freeswitch/sofia-sip/commit/907f2ac0ee504c93ebfefd676b4632a3575908c9 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-pxcp https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html https://security.gentoo.org/glsa/202210-18 https://www.debian.org/security/2023/dsa-5410 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016974 https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5410

CVE-2022-31003

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect