Input validation error in Zoom Video Communications, Inc. products - CVE-2023-22882

Vulnerability identifier: #VU73694

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22882

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing STUN packets. A remote attacker can send specially crafted UDP traffic to the application and perform a denial of service (DoS) attack.

Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux

Install updates from vendor's website.

Zoom Workplace App for iOS - update to 5.13.5 6434
Zoom Workplace Desktop App for Windows - update to 5.13.5 12053
Zoom Workplace Desktop App for macOS - update to 5.13.5 14826
Zoom Workplace App for Android - update to 5.13.5 11533
Zoom Workplace Desktop App for Linux - update to 5.13.5 431

• https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-23002

• Multiple vulnerabilities in Zoom clients