CVE-2018-8828
critical · 9.8A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
9.8
CVSS
30.4%
EPSS (exploit prob.)
98th
EPSS percentile
2018-03-20
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-193CWE-787
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| kamailio | kamailio | < 4.4.7 |
| kamailio | kamailio | >= 5.0.0, < 5.0.6 |
| kamailio | kamailio | >= 5.1.0, < 5.1.2 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow
- https://github.com/kamailio/kamailio/commit/e1d8008a09d9390ebaf698abe8909e10dfec4097
- https://usn.ubuntu.com/4240-1/
- https://www.debian.org/security/2018/dsa-4148
- https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow
- https://github.com/kamailio/kamailio/commit/e1d8008a09d9390ebaf698abe8909e10dfec4097
- https://usn.ubuntu.com/4240-1/
- https://www.debian.org/security/2018/dsa-4148
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-8828