https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 04:38:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-52986 <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_conntrack_sip: don&#39;t use simple_strtoul</p> <p>Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating the use of simple_strtoul() which assumes NUL-terminated strings.</p> <p>The previous code dereferenced pointers without bounds checks after sip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated skb data. A port that reaches the buffer limit without a trailing character is also rejected as malformed.</p> <p>Also get rid of all simple_strtoul() usage in conntrack, prefer a stricter version instead. There are intentional changes:</p> <p>- Bail out if number is &gt; UINT_MAX and indicate a failure, same for too long sequences. While we do accept 05535 as port 5535, we will not accept e.g. &#39;sip:10.0.0.1:005060&#39;. While its syntactically valid under RFC 3261, we should restrict this to not waste cycles when presented with malformed packets with 64k &#39;0&#39; characters.</p> <p>- Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch &#39;expire=&#39; and &#39;rports=&#39;; both are expected to use base-10.</p> <p>- In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k range.</p> <p>- epaddr_len now returns 0 if the port is invalid, as it already does for invalid ip addresses. This is intentional. nf_conntrack_sip performs lots of guesswork to find the righ…</p> <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_conntrack_sip: don&#39;t use simple_strtoul</p> <p>Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating the use of simple_strtoul() which assumes NUL-terminated strings.</p> <p>The previous code dereferenced pointers without bounds checks after sip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated skb data. A port that reaches the buffer limit without a trailing character is also rejected as malformed.</p> <p>Also get rid of all simple_strtoul() usage in conntrack, prefer a stricter version instead. There are intentional changes:</p> <p>- Bail out if number is &gt; UINT_MAX and indicate a failure, same for too long sequences. While we do accept 05535 as port 5535, we will not accept e.g. &#39;sip:10.0.0.1:005060&#39;. While its syntactically valid under RFC 3261, we should restrict this to not waste cycles when presented with malformed packets with 64k &#39;0&#39; characters.</p> <p>- Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch &#39;expire=&#39; and &#39;rports=&#39;; both are expected to use base-10.</p> <p>- In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k range.</p> <p>- epaddr_len now returns 0 if the port is invalid, as it already does for invalid ip addresses. This is intentional. nf_conntrack_sip performs lots of guesswork to find the righ…</p> https://vulnerability.circl.lu/vuln/cve-2026-52986