Read the docs
TI-2023-15601 Aliases CVE-2023-32307

heap-over-flow and integer-overflow in sofia-sip

Priority HIGH 72CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01056 64th percentileScored 2026-11-07
Fix Fixed sofia-sip (freeswitch): 1.13.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freeswitchsofia-sipbefore 1.13.151.13.15Patch availableCNA
  • sofia-sip Vendorfreeswitch Affected before 1.13.15 Fixed in 1.13.15 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:*before 1.13.15Vulnerablesignalwire
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:* Versions before 1.13.15 Vulnerable ·signalwire
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA sofia-sip (freeswitch) Fixed in 1.13.15

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32307

References

Advisory 2

Other 2

  • TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
  • TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
  • TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
  • TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
  • TI-2022-13048 Out-of-bounds Read in Sofia-SIP CVSS 3.1HIGH 7.5
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences