lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to…
Priority LOW 28CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.
Why it matters now
EPSS 0.02775 86th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Enterprise Linux 5
Timeline
- 2026-10-02 Threatist record created from CVE-2012-5621
- 2026-10-03 Alias added: GHSA-rwrv-fxxr-7f3g
References
Advisory 1
Other 4
- https://blogs.oracle.com/sunsecurity/entry/cve_2012_5621_denial_of
- http://ftp.gnome.org/pub/gnome/sources/ekiga/4.0/ekiga-4.0.0.news
- https://git.gnome.org/browse/ekiga/commit/?id=7d09807257
- [oss-security] 20121203 Re: CVE Request -- Ekiga (x < 4.0.0): DoS (crash) after receiving call from other party with not UTF-8 valid name
More Ekiga vulnerabilities
- TI-2007-00975 Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to… CVSS 2.0HIGH 10.0
- TI-2007-00974 Multiple format string vulnerabilities in the gm_main_window_flash_message function in… CVSS 2.0HIGH 10.0
- TI-2011-01606 Ekiga attempts to dlopen /tmp/ekiga_test.so CVSS 3.0HIGH 8.8
- TI-2007-04746 The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2)… CVSS 2.0MEDIUM 5.0
- TI-2007-04719 pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to… CVSS 2.0MEDIUM 5.0
- TI-2013-01647 The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-5621 · CVE Program
- CVE-2012-5621 · NVD
- FIRST EPSS
- GHSA-rwrv-fxxr-7f3g · GitHub Advisory Database · CC BY 4.0
- CVE-2012-5621 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences