VDB
CVE-2023-4234
CVE-2023-4234
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().
EPSS 1.15% · 64.6th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.15%
64.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedora | Fedora | |
| n/a | ofono | 2.1 |
| fedoraproject | fedora | 38, 39, 40 |
| ofono_project | ofono | 0 |
| linux | ofono | 2.1 |
Timeline
- Dec 20, 2023 CVE Published
- Apr 18, 2024 EPSS Score
- May 13, 2024 EPSS Score
- Jun 8, 2024 EPSS Score
- Jul 3, 2024 EPSS Score
- Jul 28, 2024 EPSS Score
- Sep 16, 2024 EPSS Score
- Oct 11, 2024 EPSS Score
- Nov 5, 2024 EPSS Score
- Nov 30, 2024 EPSS Score
- Dec 26, 2024 EPSS Score
- Jan 20, 2025 EPSS Score
References
- RHBZ#2255399 issue
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBTPKR3LYTTLROPXF77FL4SPLXVHNC4T/ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VG6FHQITWUNHBDGPXUQ77SZK5O5BYIBZ/ url
- https://nvd.nist.gov/vuln/detail/CVE-2023-4234 advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBTPKR3LYTTLROPXF77FL4SPLXVHNC4T url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VG6FHQITWUNHBDGPXUQ77SZK5O5BYIBZ url