VDB
CVE-2006-2923
CVE-2006-2923
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziaxphone, (f) IAX Phone, (g) X-lite, (h) MediaX, (i) Extreme Networks ePhone, and (j) iaxComm before 1.2.0, allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames, which are detected in a length check but still processed, leading to buffer overflows related to negative length values.
EPSS 4.38% · 91.2th percentile
Risk Scores
CVSS 2.0
6.400000095367432
EPSS Score
4.38%
91.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| loudhush | loudhush | 1.3.6 |
| n/a | n/a | n/a |
Timeline
- Jun 9, 2006 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
- Aug 5, 2023 EPSS Score
References
- ADV-2006-2286 vdb
- ADV-2006-2285 vdb
- http://www.loudhush.ro/changelog.txt url
- 20567 third-party-advisory
- http://www.coresecurity.com/common/showdoc.php?idx=548&idxseccion=10 url
- ADV-2006-2180 vdb
- 20623 third-party-advisory
- 20466 third-party-advisory
- 20060609 CORE-2006-0327: IAXclient truncated frames vulnerabilities mailing-list
- iaxclient-truncated-frame-bo(27047) vdb
- http://iaxclient.sourceforge.net/iaxcomm/ url
- 20900 third-party-advisory
- 18307 vdb
- ADV-2006-2284 vdb
- GLSA-200606-30 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=423099&group_id=131960 url
- 20560 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2006-2923 advisory
- http://iaxclient.sourceforge.net/iaxcomm url