openSUSE Security Update : libosip2 (openSUSE-2017-526)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

This update for libosip2 fixes the following issues :

Changes in libosip2 :

- CVE-2017-7853: In libosip2 in GNU 5.0.0, a malformed SIP
message can lead to a heap buffer overflow in the
msg_osip_body_parse() function defined in
osipparser2/osip_message_parse.c, resulting in a remote
DoS. (boo#1034570)

- CVE-2016-10326: In libosip2 in GNU oSIP 4.1.0, a
malformed SIP message can lead to a heap buffer overflow
in the osip_body_to_str() function defined in
osipparser2/osip_body.c, resulting in a remote DoS.
(boo#1034571)

- CVE-2016-10325: In libosip2 in GNU oSIP 4.1.0, a
malformed SIP message can lead to a heap buffer overflow
in the _osip_message_to_str() function defined in
osipparser2/osip_message_to_str.c, resulting in a remote
DoS. (boo#1034572)

- CVE-2016-10324: In libosip2 in GNU oSIP 4.1.0, a
malformed SIP message can lead to a heap buffer overflow
in the osip_clrncpy() function defined in
osipparser2/osip_port.c. (boo#1034574)

See also :

https://bugzilla.opensuse.org/show_bug.cgi?id=1034570
https://bugzilla.opensuse.org/show_bug.cgi?id=1034571
https://bugzilla.opensuse.org/show_bug.cgi?id=1034572
https://bugzilla.opensuse.org/show_bug.cgi?id=1034574

Solution :

Update the affected libosip2 packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 99752 ()

Bugtraq ID:

CVE ID: CVE-2016-10324
CVE-2016-10325
CVE-2016-10326
CVE-2017-7853

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now