Heap-Based Buffer Overflow in FreeSWITCH Affects Remote Code Execution
CVE-2015-7392

Currently unrated

Key Information:

Vendor

Freeswitch

Status
Freeswitch
Vendor
CVE Published:
5 October 2015

What is CVE-2015-7392?

A vulnerability exists in FreeSWITCH prior to versions 1.4.23 and 1.6.2, stemming from a heap-based buffer overflow within the parse_string function of the JSON parser. This flaw enables remote attackers to influence the execution of arbitrary code through specially crafted JSON strings containing a trailing '\u' character. As a consequence, exploitation of this vulnerability poses significant risks to system integrity and confidentiality.

References

https://freeswitch.org/stash/projects/FS/repos/freeswitch...
x_refsource_CONFIRM
http://packetstormsecurity.com/files/133781/freeswitch-He...
x_refsource_MISC
http://www.securityfocus.com/archive/1/536569/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.