CVE-2026-104594

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

These are all security issues fixed in the libosmocodec-devel-1.14.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libosmocore fixes the following issues:

Changes in libosmocore:

• Update to release 1.14.2

  • Fix buffer overflows/overreads in bssgp_rx_paging, parse_process_uss_req, osmo_dec_gcr, osmo_pbit2ubit, in the CBSP WRITE-REPLACE decoder, and in TLV tag logging. [boo#1289028, CVE-2026-104592]
  • iuup: Cure stack buffer-overflow rx IuUP with payload larger than 1024 bytes. [boo#1289027, CVE-2026-104591] [boo#1288875, CVE-2026-104597]
  • gsm: Reject BSSMAP Encryption Information IE with no selected algo or key length != 8.
  • Resolve [boo#1289029, CVE-2026-104594]

• Update to release 1.14.1

  • socket: osmo_sockaddr_from_str_and_uint(): fix memleak
  • osmo_io: Rewrite iofd_handle_send_completion() to fix multiple issues
  • osmo_io: Fix msgb memleak if iofd is unregistered during write_cb with >1 io buffers
  • netdev: Add API osmo_netdev_del_addr()

• Update to release 1.13.1

  • socket: Introduce API osmo_sock_set_nonblock()
  • gsm/rsl: add definition for TFO transparent container IE
  • vty/test: Validate optional-multi-choice param followed by optional-multi-choice param
  • gsmtap_util: Avoid sink_fd leak gsmtap_source_add_sinki() called multiple times
  • logging_vty: Allow setting gsmtap log tgt as (blocking-io|nonblocking-io|wq)
  • gsmtap_util: Increase source_fd's SO_SNDBUF to 4MB
  • osmo_io: Support rx of segments up to ~UINT16_MAX
  • osmo_io: Propagate segment_cb errors to the read_cb
  • Use same queue length for gsmtap_log and gsmtap_file

• Update to release 1.12.0

  • iuup: Explicitly discard Iu-UP-DATA.req in Initialization state
  • protocol/gsm_04_08.h: Add GSM 04.08 message types for SI21/22/23
  • vty: Add 'show runtime' command
  • Send multiple read/recvfrom/recvmsg SQEs in advance
  • Register OSMO_EXT protocol number for TCAP routing
  • AMR codec: add conversion between s-bits and codec parameters
  • AMR codec: add decoder homing frame const patterns

• Update to release 1.11.2

  • VTY: Initialize fields of struct cmd_element in order of declaration

• Update to release 1.11.1

  • lapd, lapdm: Take talloc msgb ownership when enqueueing it