Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
Summary
Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
Original description
The description as published by the source.
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, rest = record + 2 will access the memory behind \0 and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-31003 sofia-sip Fixed in: 1.13.8-r0
- Debian DEBIAN-CVE-2022-31003 sofia-sip Fixed in: 1.12.11+20110422.1-2.1+deb11u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- patch github.com
- web lists.debian.org