CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32307 – heap-over-flow and integer-overflow in sofia-sip
https://notcve.org/view.php?id=CVE-2023-32307
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade. • https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-rm4c-ccvf-ff9c https://lists.debian.org/debian-lts-announce/2023/06/msg00002.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OY66DOQ3B7GULJTI66X5HNX5FU3P65CX https://www.debian.org/security/2023/dsa-5431 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2023-22741 – heap-over-flow in stun_parse_attribute in sofia-sip
https://notcve.org/view.php?id=CVE-2023-22741
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. • https://github.com/freeswitch/sofia-sip/commit/da53e4fbcb138b080a75576dd49c1fff2ada2764 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54 https://www.debian.org/security/2023/dsa-5410 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 1CVE-2022-31003 – Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
https://notcve.org/view.php?id=CVE-2022-31003
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue. Sofia-SIP es una biblioteca de agente de usuario del Protocolo de Iniciación de Sesión (SIP) de código abierto. • https://github.com/freeswitch/sofia-sip/commit/907f2ac0ee504c93ebfefd676b4632a3575908c9 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-pxcp https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html https://security.gentoo.org/glsa/202210-18 https://www.debian.org/security/2023/dsa-5410 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-31002 – Out-of-bounds Read in Sofia-SIP
https://notcve.org/view.php?id=CVE-2022-31002
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue. Sofia-SIP es una librería de agente de usuario del Protocolo de Iniciación de Sesión (SIP) de código abierto. • https://github.com/freeswitch/sofia-sip/commit/51841eb53679434a386fb2dcbca925dcc48d58ba https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-g3x6-p824-x6hm https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html https://security.gentoo.org/glsa/202210-18 https://www.debian.org/security/2023/dsa-5410 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-31001 – Out-of-bounds Read in Sofia-SIP
https://notcve.org/view.php?id=CVE-2022-31001
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue. Sofia-SIP es una biblioteca de agente de usuario del Protocolo de Iniciación de Sesión (SIP) de código abierto. • https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9g https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html https://security.gentoo.org/glsa/202210-18 https://www.debian.org/security/2023/dsa-5410 • CWE-125: Out-of-bounds Read •