CVE-2007-4924

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-10-08 · updated 2026-06-16
Weakness: CWE-20

Description

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Affected products

Gnome Ekiga: through 2.0.9
Openh323 Project Openh323: through 2.2.3

References

http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
http://mail.gnome.org/archives/ekiga-list/2007-September/msg00103.html
http://openh323.cvs.sourceforge.net/openh323/opal/src/sip/sippdu.cxx?r1=2.83.2.19&r2=2.83.2.20
http://osvdb.org/41637
http://secunia.com/advisories/27118
http://secunia.com/advisories/27128
http://secunia.com/advisories/27129
http://secunia.com/advisories/27271
http://secunia.com/advisories/27524
http://secunia.com/advisories/28380
http://www.mandriva.com/security/advisories?name=MDKSA-2007:205
http://www.redhat.com/support/errata/RHSA-2007-0957.html

Get alerted when CVE-2007-4924 or the next vulnerability affects your stack