Description
Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ekiga | 2.0.2-7.0.2 | RHSA-2007:0087 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | ekiga | 2.0.2-7.0.2 | RHSA-2007:0087 |
Advisories 1
- RHSA-2007:0087 Red Hat Security Advisory: ekiga security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- MDKSA-2007:044 vendor-advisory
- 25119 third-party-advisory
- FEDORA-2007-262 vendor-advisory
- [Ekiga-list] 20070213 Ekiga 2.0.5 available mailing-list
- http://labs.musecurity.com/advisories/MU-200702-01.txt
- 31939 vdb-entry
- 22613 vdb-entry
- 24271 third-party-advisory
- 24379 third-party-advisory
- SUSE-SR:2007:009 vendor-advisory
- GLSA-200703-25 vendor-advisory
- 24228 third-party-advisory
- DSA-1262 vendor-advisory
- oval:org.mitre.oval:def:11642 vdb-entry signature
- 24680 third-party-advisory
- FEDORA-2007-263 vendor-advisory
- RHSA-2007:0087 vendor-advisory
- 24229 third-party-advisory
- http://www.ekiga.org/index.php?rub=10&archive=1
- 24194 third-party-advisory
- 1017673 vdb-entry
- ADV-2007-0655 vdb-entry
- USN-426-1 vendor-advisory