Every CVE Search/ Get API key

CVE-2007-4924

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323...

5.0 MediumPublic exploitFix available

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Exploit likelihood

10.7%Down 1.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Record
CVE-2007-4924
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Record
CVE-2007-4924
Updated
2026-11-02
EUVDEUVD-2007-4905 No score

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Record
EUVD-2007-4905
Updated
2026-11-03
GitHub AdvisoriesGHSA-55xh-gq2p-rgv2 No score

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323...

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

Record
GHSA-55xh-gq2p-rgv2
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opal
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal
Red Hat:enterprise_linux:5::client
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal
Red Hat:rhel_productivity:5
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal-debuginfo
Red Hat:rhel_productivity:5
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1
opal-devel
Red Hat:rhel_productivity:5
 before 0:2.2.2-1.1.0.1
0:2.2.2-1.1.0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBOpenH323 Opal SIP Protocol - Remote Denial of Service2009-07-24

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, exploits, facts, references, titleExploit-DB, GitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-4924 is a medium vulnerability (CVSS 5.0) in Ekiga, published October 8, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.7%, the 95th percentile. Fixed in opal 0:2.2.2-1.1.0.1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open