An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pjproject | Apr 11, 2018 | Nov 17, 2017 |
| Ubuntu | — | Upgrade libpjsua2 (Ubuntu Pro)Upgrade libpjsip2 (Ubuntu Pro)Upgrade libpjnath2 (Ubuntu Pro)Upgrade python-pjproject (Ubuntu Pro)Upgrade libpj2 (Ubuntu Pro)Upgrade libpjmedia2 (Ubuntu Pro) | Jun 26, 2025 | Nov 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
