CVE-2007-4897 pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf function, related to a....
MediumCVSS 5.0
EPSS 10.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf function, related to a "memory management flaw". NOTE: this issue was originally reported as being in the SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ekiga | = 2.0.5 | No fix listed |
References
- blog.s21sec.com
- 20070912 S21SEC-036-EN Ekiga <= 2.0.5 Denial of service mailing-list
- openh323.cvs.sourceforge.net
- 27127 third-party-advisory vendor-advisory
- 27150 third-party-advisory vendor-advisory
- 27518 third-party-advisory vendor-advisory
- 28385 third-party-advisory vendor-advisory
- 3138 third-party-advisory
- MDKSA-2007:206 vendor-advisory
- RHSA-2007:0932 vendor-advisory
- www.s21sec.com
- 20070912 S21SEC-036-EN Ekiga <= 2.0.5 Denial of service mailing-list
- 25642 vdb-entry
- 1018683 vdb-entry
- USN-561-1 vendor-advisory
- bugzilla.redhat.com
- ekiga-sipurlgethostaddress-dos(36568) vdb-entry
- oval:org.mitre.oval:def:10928 signature vdb-entry