CVE-2015-7392: Buffer Overflow
Published Oct 5, 2015
·Updated
Heap-based buffer overflow in the parsestring function in libs/esl/src/esljson.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSONParse.
Affected Software
2 affected components
FreeSWITCH FreeSWITCH<=1.4.21
FreeSWITCH FreeSWITCH=1.6.0
Event History
Oct 5, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7392?
CVE-2015-7392 is considered to be of high severity due to the potential for remote code execution.
2
How do I fix CVE-2015-7392?
To fix CVE-2015-7392, upgrade FreeSWITCH to version 1.4.23 or later, or 1.6.2 or later.
3
What types of systems are affected by CVE-2015-7392?
CVE-2015-7392 affects FreeSWITCH versions prior to 1.4.23 and 1.6.x prior to 1.6.2.
4
What attack vector does CVE-2015-7392 exploit?
CVE-2015-7392 can be exploited via a specially crafted JSON string that includes a trailing \u character.
5
Who can be impacted by CVE-2015-7392?
Remote attackers can exploit CVE-2015-7392 to execute arbitrary code on vulnerable FreeSWITCH installations.