PJSIP: Heap Buffer Overflow

Background PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Description Please review the CVE identifier referenced below for details. Impact Please review the CVE identifier...

tailscale:stun_parser_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6297746184142848 Project: tailscale Fuzzing Engine: libFuzzer Fuzz Target: stunparserfuzzer Job Type: libfuzzerasantailscale Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer: address ASAN...

Fedora: Security Advisory for libre (FEDORA-2024-a63e807450)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-e34efa1300)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for baresip (FEDORA-2024-a15fe3f120)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: libre-3.10.0-1.fc40

Libre is a generic library for real-time communications with async I/O support. Features are a SIP stack RFC 3261, SDP, RTP and RTCP, SRTP and SRTCP Secure RTP, DNS client, STUN/TURN/ICE stack, BFCP, HTTP stack with client/server, Websockets, Jitter buffer, async I/O poll, epoll, select, kqueue,...

[SECURITY] Fedora 40 Update: baresip-3.10.1-1.fc40

A modular SIP user-agent with support for audio and video, and many IETF standards such as SIP, SDP, RTP/RTCP and STUN/TURN/ICE for both, IPv4 and IPv6. Additional modules provide support for audio codecs like Codec2, G.711, G.722, G.726, GSM, L16, MPA and Opus, audio drivers like ALSA, GStreamer...

Fedora 38 : sofia-sip (2024-b9c02df30f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b9c02df30f advisory. Security fix for CVE-2023-32307 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

RTPEngine mr11.5.1.6 Denial Of Service

RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation - Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race - Vendor...

TOTOLINK X6000R security vulnerabilities

TOTOLINK X6000R is a wireless router from China Gion Electronics that supports WiFi 6 technology with high concurrent connections and dual-band transmission. TOTOLINK X6000R suffers from a command execution vulnerability, which originates from the sub4119A0 function's stunuser parameter failing t...

Zoom Client for Meetings < 5.13.5 Vulnerability (ZSB-23002)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.13.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-23002 advisory. - Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted...

Sofia-SIP Heap Buffer Overflow DoS

The vulnerability of the Sofia-SIP user agent library session initiation protocol relates to the possibility of writing beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted STUN packets remotely...

Ubuntu: Security Advisory (USN-6448-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Sofia-SIP vulnerability (USN-6448-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6448-1 advisory. Xu Biang discovered that Sofia-SIP did not properly manage memory when handling STUN packets. An attacker coul...

Ubuntu 23.10 : Ring vulnerabilities (USN-6422-2)

The remote Ubuntu 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6422-2 advisory. It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a...

coturn:FuzzStun: Use-of-uninitialized-value in stun_check_message_integrity_by_key_str

Project: https://github.com/coturn/coturn.git Detailed Report: https://oss-fuzz.com/testcase?key=6454671998582784 Project: coturn Fuzzing Engine: libFuzzer Fuzz Target: FuzzStun Job Type: libfuzzermsancoturn Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Ubuntu 18.04 ESM / 20.04 LTS / 23.04 : Ring vulnerabilities (USN-6422-1)

The remote Ubuntu 18.04 ESM / 20.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6422-1 advisory. It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a speciall...

Cisco Nexus 1000V ESXi Hypervisor Denial of Service (CVE-2013-1210)

Array index error in the Virtual Ethernet Module VEM kernel driver for VMware ESXi in Cisco NX-OS on the Nexus 1000V, when STUN debugging is enabled, allows remote attackers to cause a denial of service ESXi crash and purple screen of death by sending crafted STUN packets to a VEM, aka Bug ID...

Vishing Goes High-Tech: New 'Letscall' Malware Employs Voice Traffic Routing

Researchers have issued a warning about an emerging and advanced form of voice phishing vishing known as "Letscall." This technique is currently targeting individuals in South Korea. The criminals behind "Letscall" employ a multi-step attack to deceive victims into downloading malicious apps from...

Debian DSA-5431-1 : sofia-sip - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5431 advisory. - Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to GHSA-8599-x7rq-fr54, several other potential heap-over-fl...