CVE-2018-14767

Priority
Description
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with
a double "To" header and an empty "To" tag causes a segmentation fault and
crash. The reason is missing input validation in the
"build_res_buf_from_sip_req" core function. This could result in denial of
service and potentially the execution of arbitrary code.
Notes
Package
Upstream:released (5.1.4-1)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was needs-triage)
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):needed
Ubuntu 20.04 LTS (Focal Fossa):not-affected (5.2.1-1)
Ubuntu 20.10 (Groovy Gorilla):not-affected (5.2.1-1)
More Information

Updated: 2020-09-09 21:58:06 UTC (commit b67d7d8b03f173f825cd706df5bd078bca500b0e)