--- title: "CVE-2023-32307\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2023-32307?format=md keywords: index, follow --- # CVE-2023-32307 Publication date 26 May 2023 Last updated 4 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **7.5 · High** [Score breakdown](https://ubuntu.com/security/CVE-2023-32307?format=md#impact-score) Toggle side navigation ## Description Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun\_parse\_attr\_error\_code and stun\_parse\_attr\_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr\_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | sip4 | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Ignored end of life, was needs-triage | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | sofia-sip | 23.10 mantic | Fixed 1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1 | | 23.04 lunar | Fixed 1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1 | | 22.10 kinetic | Ignored end of life, was needs-triage | | 22.04 LTS jammy | Fixed 1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2 | | 20.04 LTS focal | Fixed 1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2 | | 18.04 LTS bionic | Fixed 1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1 Ubuntu Pro | | 16.04 LTS xenial | Fixed 1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2 Ubuntu Pro | | 14.04 LTS trusty | Ignored end of standard support | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 7.5 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | None | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 7.5 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32307) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-32307) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2023-32307) * [Debian](https://security-tracker.debian.org/tracker/CVE-2023-32307) ### Related Ubuntu Security Notices (USN) + [USN-6448-1](https://usn.ubuntu.com/USN-6448-1) + Sofia-SIP vulnerability + 24 October 2023 ### Other references * * *