CVE-2023-4234

Name of the Vulnerable Software and Affected Versions oFono (affected versions not specified)

Description A flaw in oFono, an Open Source Telephony on Linux, is related to a stack overflow bug triggered within the decode submit report() function during SMS decoding in PDU format. This issue may allow a remote attacker to execute arbitrary code. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for the memcpy length in decode submit(), but it was forgotten in decode submit report().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.