CVE-2023-27598

OpenSIPS vulnerable before 3.1.7 and 3.2.4: sending a malformed Via header triggers a segmentation fault in calc_tag_suffix, passing uninitialized strings to MD5StringArray and causing a crash (DoS). Exploitation requires no special privileges beyond triggering the vulnerable code; complete impac...

CVE-2023-27598 OpenSIPS has vulnerability in the parse_via() function

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed Via header to OpenSIPS triggers a segmentation fault when the function calctagsuffix is called. A specially crafted Via header, which is deemed correct by the parser, will...

CVE-2023-27597 OpenSIPS has vulnerability in the parse_uri() function

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function rewriteruri, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations...

CVE-2023-27597 OpenSIPS has vulnerability in the parse_uri() function

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function rewriteruri, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations...

CVE-2023-27597

OpenSIPS (SIP server) is affected by CVE-2023-27597. A flaw in the function rewrite_ruri can cause a segmentation fault when processing specially crafted SIP messages, leading to a crash. The issue can impact configurations that rely on affected code paths, such as the setport function. The vulne...

CVE-2023-27597 OpenSIPS has vulnerability in the parse_uri() function

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function rewriteruri, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations...

CVE-2020-27507

The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact...

CVE-2020-27507

The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact...

Buffer overflow

The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact...

CVE-2023-27596

OpenSIPS is affected prior to versions 3.1.8 and 3.2.5. A malformed SDP body sent repeatedly to a configuration using the stream_process function can cause the server to crash; this was discovered during coverage-guided fuzzing of codec_delete_except_re. The issue affects configurations relying o...

CVE-2023-27596 OpenSIPS has vulnerability in the codec_delete_XX() functions

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the streamprocess function. This issue was discovered during coverage guided...

OpenSIPS 安全漏洞

OpenSIPS is a GPL-licensed SIP server implementation from the individual developers of OpenSIPS. A security vulnerability exists in OpenSIPS versions 2.3 through 3.2, which stems from a memory leak detected via the function parsemirequest...

CVE-2020-27507

The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact...

Kamailio SIP Server Out of Bounds Read (CVE-2018-14767)

An out-of-bounds read vulnerability exists in Kamailio . Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information...

drachtio-server 缓冲区错误漏洞

drachtio-server is a drachtio open source SIP server built on the sofia SIP stack. A buffer error vulnerability exists in drachtio-server version 0.8.18, which stems from the fact that an attacker can submit an overly long Request-URI via an INVITE request resulting in an out-of-bounds read of a...

drachtio-server information disclosure vulnerability

drachtio-server is a drachtio open source SIP server built on the sofia SIP stack. drachtio drachtio-server version 0.8.18 has an information disclosure vulnerability that stems from the fact that local users can retrieve sensitive data and attackers can use the vulnerability to obtain sensitive...

drachtio-server memory mis-reference vulnerability

drachtio-server is a SIP server built on the sofia SIP stack by drachtio open source. drachtio drachtio-server version 0.8.18 is vulnerable to a memory misquoting vulnerability that stems from the request-handler.cpp component receiving requests when the event The cb instruction responsible for...

asterisk -- Remote Crash Vulnerability in PJSIP channel driver

The Asterisk project reports: Given a scenario where an outgoing call is placed from Asterisk to a remote SIP server it is possible for a crash to occur...

Debian DLA-1503-1 : kamailio security update

It was discovered that there was a denial of service and a potential arbitrary code execution vulnerability in the kamailio SIP server. A specially crafted SIP message with an invalid 'Via' header could cause a segmentation fault and crash Kamailio due to missing input validation. For Debian 8...

[SECURITY] [DLA 1503-1] kamailio security update

Package : kamailio Version : 4.2.0-2+deb8u5 CVE ID : CVE-2018-16657 Debian Bug : 908324 It was discovered that there was a denial of service and a potential arbitrary code execution vulnerability in the kamailio SIP server. A specially-crafted SIP message with an invalid "Via" header could cause ...