[SECURITY] [DSA 5431-1] sofia-sip security update

2023-06-1614:44:18

lists.debian.org

debian

denial of service

sofia-sip

security update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

43.2%

JSON

Debian Security Advisory DSA-5431-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
June 16, 2023 https://www.debian.org/security/faq

Package : sofia-sip
CVE ID : CVE-2023-32307
Debian Bug : 1036847

Xu Biang discovered that missing input sanitising in Sofia-SIP, a SIP
User-Agent library could result in denial of service.

For the oldstable distribution (bullseye), this problem has been fixed
in version 1.12.11+20110422.1-2.1+deb11u2.

We recommend that you upgrade your sofia-sip packages.

For the detailed security status of sofia-sip please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sofia-sip

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10armhflibsofia-sip-ua-glib-dev< 1.12.11+20110422.1-2.1+deb10u4libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb10u4_armhf.deb
Debian10allsofia-sip-doc< 1.12.11+20110422.1-2.1+deb10u4sofia-sip-doc_1.12.11+20110422.1-2.1+deb10u4_all.deb
Debian10arm64libsofia-sip-ua0-dbgsym< 1.12.11+20110422.1-2.1+deb10u4libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb10u4_arm64.deb
Debian11amd64sofia-sip-bin-dbgsym< 1.12.11+20110422.1-2.1+deb11u2sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb11u2_amd64.deb
Debian10amd64libsofia-sip-ua0-dbgsym< 1.12.11+20110422.1-2.1+deb10u4libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb10u4_amd64.deb
Debian11armellibsofia-sip-ua-glib-dev< 1.12.11+20110422.1-2.1+deb11u2libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb11u2_armel.deb
Debian11arm64sofia-sip-bin-dbgsym< 1.12.11+20110422.1-2.1+deb11u2sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb11u2_arm64.deb
Debian10armhfsofia-sip-bin-dbgsym< 1.12.11+20110422.1-2.1+deb10u4sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb10u4_armhf.deb
Debian11mipsellibsofia-sip-ua0-dbgsym< 1.12.11+20110422.1-2.1+deb11u2libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb11u2_mipsel.deb
Debian10arm64libsofia-sip-ua-glib-dev< 1.12.11+20110422.1-2.1+deb10u4libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb10u4_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armhf	libsofia-sip-ua-glib-dev	< 1.12.11+20110422.1-2.1+deb10u4	libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb10u4_armhf.deb
Debian	10	all	sofia-sip-doc	< 1.12.11+20110422.1-2.1+deb10u4	sofia-sip-doc_1.12.11+20110422.1-2.1+deb10u4_all.deb
Debian	10	arm64	libsofia-sip-ua0-dbgsym	< 1.12.11+20110422.1-2.1+deb10u4	libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb10u4_arm64.deb
Debian	11	amd64	sofia-sip-bin-dbgsym	< 1.12.11+20110422.1-2.1+deb11u2	sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb11u2_amd64.deb
Debian	10	amd64	libsofia-sip-ua0-dbgsym	< 1.12.11+20110422.1-2.1+deb10u4	libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb10u4_amd64.deb
Debian	11	armel	libsofia-sip-ua-glib-dev	< 1.12.11+20110422.1-2.1+deb11u2	libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb11u2_armel.deb
Debian	11	arm64	sofia-sip-bin-dbgsym	< 1.12.11+20110422.1-2.1+deb11u2	sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb11u2_arm64.deb
Debian	10	armhf	sofia-sip-bin-dbgsym	< 1.12.11+20110422.1-2.1+deb10u4	sofia-sip-bin-dbgsym_1.12.11+20110422.1-2.1+deb10u4_armhf.deb
Debian	11	mipsel	libsofia-sip-ua0-dbgsym	< 1.12.11+20110422.1-2.1+deb11u2	libsofia-sip-ua0-dbgsym_1.12.11+20110422.1-2.1+deb11u2_mipsel.deb
Debian	10	arm64	libsofia-sip-ua-glib-dev	< 1.12.11+20110422.1-2.1+deb10u4	libsofia-sip-ua-glib-dev_1.12.11+20110422.1-2.1+deb10u4_arm64.deb