Buffer overflow in Wernerd Zrtpcpp

CVE-2013-2221

Heap-based buffer overflow in the ZRtp::storeMsgTemp function in GNU ZRTPCPP before 3.2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large packet.

Vulnerability class: Buffer Overflow

EPSS: 0.043 (90.2th percentile) — read the EPSS interpretation.

Affected products

Wernerd Zrtpcpp — versions 2.1.2, 2.2.0, 2.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (Exploit, x_refsource_MISC)
secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)