Vendor
OpenSIPS versions 3.6.8 and 4.0.1 and earlier are vulnerable to a remote out-of-bounds read in the rtpproxy_offer and rtpproxy_answer functions, which can lead to denial-of-service or information disclosure.