CVE-2023-4233: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS…

PriorityP345high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EPSS

1.01%

59.6th percentile

A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS PDU decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	ofono	< ofono 2.10-1 (forky)	ofono 2.10-1 (forky)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
ofono_project	ofono	< 2.1	2.1
ofono_project	ofono	>= 0 < 2.10-1	2.10-1
ofono_project	ofono	>= 0 < 2.10-1	2.10-1
ofono_project	ofono	>= 0 < 1.31-3ubuntu1.1	1.31-3ubuntu1.1
ofono_project	ofono	>= 0 < 1.31-3ubuntu3.24.04.1	1.31-3ubuntu3.24.04.1
ofono_project	ofono	>= 0 < 1.17.bzr6912+16.04.20160314.3-0ubuntu1+esm1	1.17.bzr6912+16.04.20160314.3-0ubuntu1+esm1
ofono_project	ofono	>= 0 < 1.21-1ubuntu1+esm1	1.21-1ubuntu1+esm1
ofono_project	ofono	>= 0 < 1.31-2ubuntu1+esm1	1.31-2ubuntu1+esm1

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

osv8.1HIGH

vendor_debian8.1HIGH

vendor_ubuntu8.1HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.