{"id":"CVE-2018-14767","aliases":["ALPINE-CVE-2018-14767","DEBIAN-CVE-2018-14767","DLA-1471-1","DSA-4267-1","EUVD-2018-6653","GHSA-v76g-6p6j-7485","UBUNTU-CVE-2018-14767","USN-7416-1"],"status":"published","title":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header...","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.29303,"percentile":0.98189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-07-31T06:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"kamailio","fixed_in":["5.0.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"kamailio","fixed_in":["5.1.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"kamailio","fixed_in":["5.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kamailio","fixed_in":["5.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kamailio","fixed_in":["5.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"kamailio","fixed_in":["4.2.0-2+deb8u4"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"kamailio","fixed_in":["4.4.4-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"kamailio","fixed_in":["4.3.4-1.1ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","fixed_in":["5.1.2-1ubuntu2+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.0.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-2+deb8u4"}]}],"versions":["4.2.0-2","4.2.0-2+deb8u1","4.2.0-2+deb8u2","4.2.0-2+deb8u3"]},{"source":"osv","ecosystem":"Debian:9","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4-2+deb9u2"}]}],"versions":["4.4.4-2","4.4.4-2+deb9u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.1ubuntu2.1+esm2"}]}],"versions":["4.3.1-2ubuntu1","4.3.4-1.1ubuntu1","4.3.4-1.1ubuntu2","4.3.4-1.1ubuntu2.1","4.3.4-1.1ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1ubuntu2+esm2"}]}],"versions":["4.4.2-3ubuntu5","5.0.4-1ubuntu1","5.1.1-1ubuntu1","5.1.1-1ubuntu4","5.1.2-1ubuntu1","5.1.2-1ubuntu2","5.1.2-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.1ubuntu2.1+esm2"}]}],"versions":["4.3.1-2ubuntu1","4.3.4-1.1ubuntu1","4.3.4-1.1ubuntu2","4.3.4-1.1ubuntu2.1","4.3.4-1.1ubuntu2.1+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1ubuntu2+esm2"}]}],"versions":["4.4.2-3ubuntu5","5.0.4-1ubuntu1","5.1.1-1ubuntu1","5.1.1-1ubuntu4","5.1.2-1ubuntu1","5.1.2-1ubuntu2","5.1.2-1ubuntu2+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-1ubuntu0.1~esm2"}]}],"versions":["5.2.3-1build3","5.2.3-1build4","5.3.0-2","5.3.1-1","5.3.2-1build1","5.3.2-1build2","5.3.2-1build3","5.3.2-1ubuntu0.1~esm1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"kamailio","product":"kamailio"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4267","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://skalatan.de/blog/advisory-hw-2018-05","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14767"},{"url":"https://github.com/advisories/GHSA-v76g-6p6j-7485"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-14767","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14767","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14767","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7416-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28361","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:00:00Z","modified":"2024-08-05T09:38:13.435Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6653","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:00:00Z","modified":"2024-08-05T09:38:13Z","updated_at":"2026-11-03T02:39:45.703245Z"}],"ghsa":[{"id":"GHSA-v76g-6p6j-7485","title":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header...","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2022-05-14T02:57:06Z","modified":"2023-02-02T05:06:55Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:23.774238Z"}],"nvd":[{"id":"CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:29:00.227Z","modified":"2026-06-17T01:41:34.45Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"ALPINE-CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:29:00.227Z","modified":"2026-10-23T17:17:55.21780466Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:29:00.227Z","modified":"2026-10-24T10:30:54.147564066Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:29:00.227Z","modified":"2026-10-23T18:03:54.928608993Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-14767","description":"In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double \"To\" header and an empty \"To\" tag causes a segmentation fault and crash. The reason is missing input validation in the \"build_res_buf_from_sip_req\" core function. This could result in denial of service and potentially the execution of arbitrary code.","status":"published","published":"2018-07-31T06:29:00Z","modified":"2026-02-04T02:45:30.987265Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1471-1","title":"kamailio - security update","status":"published","published":"2018-08-19T00:00:00Z","modified":"2026-03-09T01:01:02.911763Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4267-1","title":"kamailio - security update","status":"published","published":"2018-08-08T00:00:00Z","modified":"2026-03-09T02:09:27.53854Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-7416-1","title":"kamailio vulnerabilities","description":"Stelios Tsampas discovered that Kamailio did not correctly handle certain\nmemory operations, which could lead to a buffer overflow. A remote attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2385)\n\nHenning Westerholt discovered that Kamailio did not correctly handle\nduplicated headers, which could lead to a segmentation fault. A remote\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2018-14767)\n\nIt was discovered that Kamailio did not correctly handle parsing certain\nheaders containing whitespace characters. An authenticated attacker could\npossibly use this issue to gain access to unauthorized resources and\nexpose sensitive information. This issue only affected Ubuntu 18.04 LTS\nand Ubuntu 20.04 LTS. (CVE-2020-28361)\n","status":"published","published":"2025-04-07T01:35:36Z","modified":"2026-06-25T13:32:30.276515707Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}