CVE-2023-32307

Summary

CVE-2023-32307 is a vulnerability affecting the open-source Sofia-SIP library, which complies with the IETF RFC3261 specification for SIP User-Agents. This issue involves insufficient length checks when handling STUN packets, leading to heap-overflows and integer-overflows in the functions stun_parse_attr_error_code and stun_parse_attr_uint32. While a previous patch (GHSA-8599-x7rq-fr54) addressed the problem when attr_type did not match the enum value, there are still vulnerabilities in the handling of valid cases. These flaws can result in out-of-bounds reads and integer-overflows, potentially leading to crashes, high memory consumption, or more serious consequences. Users are strongly advised to upgrade to version 1.13.15 to mitigate these risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.