CVE-2018-14767

In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.

• CWE-20

• https://lists.debian.org/debian-lts-announce/2018/08/msg00018.htmlMailing List, Third Party Advisory
• https://skalatan.de/blog/advisory-hw-2018-05Exploit, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4267Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/08/msg00018.htmlMailing List, Third Party Advisory
• https://skalatan.de/blog/advisory-hw-2018-05Exploit, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4267Third Party Advisory

Published

Jul 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14746Command Injection vulnerability in QTS 4.3.5 build 20181013,…
• CVE-2018-14747NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20…
• CVE-2018-14748Improper Authorization vulnerability in QTS 4.3.5 build 2018…
• CVE-2018-14749Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, Q…
• CVE-2018-1475IBM BigFix Platform 9.2 and 9.5 uses an inadequate account l…
• CVE-2018-1476IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5…5.3
• CVE-2018-14768Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS…
• CVE-2018-14769VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
• CVE-2018-14770VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote…
• CVE-2018-14771VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote…
• CVE-2018-14772Pydio 4.2.1 through 8.2.1 has an authenticated remote code e…
• CVE-2018-14773An issue was discovered in Http Foundation in Symfony 2.7.0 …6.5