CVE-2023-32307

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122 CWE-190 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-323089.8anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.p CVE-2023-323097.5PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possibl CVE-2023-32316.5A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component CVE-2023-323108.1DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages CVE-2023-323114.3CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace pe CVE-2023-323125.3UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected CVE-2023-323135.3vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read CVE-2023-3231410.0vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to a CVE-2023-323157.5Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was fo CVE-2023-323164.3CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplor CVE-2023-323177.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS chea CVE-2023-323186.7Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevente