Log in Start free

Vulnerability · Published Mar 22, 2022 · Assigned by GitHub_M

CVE-2022-24764Stack buffer overflow in pjproject

High 7.5

In plain English

A high-severity buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.12.1-r0ALPINE-CVE-2022-24764
Alpine:v3.21pjproject2.12.1-r0ALPINE-CVE-2022-24764
Alpine:v3.22pjproject2.12.1-r0ALPINE-CVE-2022-24764
Alpine:v3.23pjproject2.12.1-r0ALPINE-CVE-2022-24764
Alpine:v3.24pjproject2.12.1-r0ALPINE-CVE-2022-24764
Debian:14asterisk1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1DEBIAN-CVE-2022-24764
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2022-24764

Affected products (as reported)

VendorProductVersions
pjsip pjproject <= 2.12

Weakness: CWE-120, CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References