CVE-2022-31003
Summary
| CVE | CVE-2022-31003 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-31 20:15:00 UTC |
| Updated | 2023-05-24 21:15:00 UTC |
| Description | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue. |
Risk And Classification
Problem Types: CWE-787 | CWE-122
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Application | Signalwire | Sofia-sip | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-5410-1 sofia-sip | DEBIAN | www.debian.org | |
| Sofia-SIP: Multiple Vulnerabilities (GLSA 202210-18) — Gentoo security | GENTOO | security.gentoo.org | |
| Merge pull request from GHSA-8w5j-6g2j-pxcp · freeswitch/sofia-sip@907f2ac · GitHub | MISC | github.com | |
| sdp_parse Heap-buffer-overflow · Advisory · freeswitch/sofia-sip · GitHub | CONFIRM | github.com | |
| [SECURITY] [DLA 3091-1] sofia-sip security update | MLIST | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 180986 Debian Security Update for sofia-sip (DLA 3091-1)
- 181801 Debian Security Update for sofia-sip (DSA 5410-1)
- 199225 Ubuntu Security Notification for Sofia-SIP Vulnerabilities (USN-5932-1)
- 502678 Alpine Linux Security Update for sofia-sip
- 504408 Alpine Linux Security Update for sofia-sip
- 710654 Gentoo Linux Sofia-SIP Multiple Vulnerabilities (GLSA 202210-18)