Improper input validation in Yate Yet Another Telephony Engine
CVE-2007-1693
The SIP channel module in Yet Another Telephony Engine (Yate) before 1.2.0 sets the caller_info_uri parameter using an incorrect variable that can be NULL, which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a Call-Info header without a purpose parameter.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.024 (81.9th percentile) — read the EPSS interpretation.
Affected products
- Yate Yet_another_telephony_engine
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)