CVE-2018-12584

The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate...

9.8 CriticalPublic exploit

The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of service (buffer overflow) or possibly execute arbitrary code when TLS communication is enabled.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

23.7%Up 8.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2018-12584
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-120
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-12584
Updated: 2026-11-02

EUVDEUVD-2018-4543 No score

Record: EUVD-2018-4543
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wj2v-cw66-5qcg 9.8

The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate...

Record: GHSA-wj2v-cw66-5qcg
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

OSV 9.8

Record: CVE-2018-12584
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-12584 9.8

Record: UBUNTU-CVE-2018-12584
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`resiprocate` Debian:8 From an advisory covering 2 CVEs	before 1:1.9.7-5+deb8u1, plus listed versions 1:1.9.7-5	1:1.9.7-5+deb8u1
`resiprocate` Debian:9 From an advisory covering 2 CVEs	before 1:1.11.0~beta1-3+deb9u2, plus listed versions 1:1.11.0~beta1-31:1.11.0~beta1-3+deb9u1	1:1.11.0~beta1-3+deb9u2
`resiprocate` Ubuntu:16.04:LTS	All versions, plus listed versions 1:1.10.0-11:1.10.1-11:1.10.1-21:1.10.1-2ubuntu1	None known
`resiprocate` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.11.0~beta5-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	reSIProcate 1.10.2 - Heap Overflow	2018-08-09

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12584 is a critical vulnerability (CVSS 9.8) in Resiprocate, published July 16, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.7%, the 97th percentile. No source names a fixed version.

References

Show 5 moreShow less