MGASA-2026-0587

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0587.html
Import Source
https://advisories.mageia.org/MGASA-2026-0587.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0587
Upstream
Published
2026-11-10T16:31:41Z
Modified
2026-11-10T16:45:03Z
Summary
Updated sofia-sip package fixes a security vulnerability
Details

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.

References
Credits

Affected packages

Mageia:10 / sofia-sip

Package

Name
sofia-sip
Purl
pkg:rpm/mageia/sofia-sip?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.13.19-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0587.json"