CVE-2018-20743

HIGH

Mumble < 1.2.19 - Denial of Service via Message Flood

Title source: llm
STIX 2.1

Description

murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.

References (9)

Core 9
Core References
Issue Tracking, Mailing List, Third Party Advisory x_refsource_misc
https://bugs.debian.org/919249
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4402
Patch, Third Party Advisory x_refsource_misc
https://github.com/mumble-voip/mumble/pull/3510
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/02/msg00006.html
Patch, Third Party Advisory x_refsource_misc
https://github.com/mumble-voip/mumble/issues/3505
Patch, Third Party Advisory x_refsource_misc
https://github.com/mumble-voip/mumble/pull/3512

Scores

CVSS v3 7.5
EPSS 0.0362
EPSS Percentile 88.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (3)
debian/debian_linux 8.0
debian/debian_linux 9.0
mumble/mumble < 1.2.19
Published Jan 25, 2019
Tracked Since Feb 18, 2026