CVE-2018-14767: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2018-14767 is a critical (CVSS 9.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 29.30% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 31-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
29.30%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 29.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (skalatan.de)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- kamailio< 5.1.4-1 | < 4.4.4-2+deb9u2 | < 4.2.0-2+deb8u4
- debian_linuxEOL8.0 | 9.0
Alpine1 product
- kamailio≥ 5.1.0, < 5.1.4-r0 | ≥ 5.1.0, < 5.0.2-r4
Kamailio1 product
- kamailio< 5.0.7 | ≥ 5.1.0, < 5.1.4
Ubuntu1 product
- kamailio< 4.3.4-1.1ubuntu2.1+esm2 | < 5.1.2-1ubuntu2+esm2
4 vendors · 5 products
References
8 links
- lists.debian.org/debian-lts-announce/2018/08/msg00018.htmlMailing ListX Refsource MLISTThird Party Advisory