PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pjproject | Aug 22, 2024 | Dec 22, 2021 |
| Debian | — | Upgrade ringUpgrade asterisk | Mar 29, 2022 | Dec 22, 2021 |
| Freebsd | — | Upgrade asterisk16Upgrade asterisk18 | Nov 4, 2022 | Mar 5, 2022 |
| Gentoo Linux | — | Upgrade net-libs/pjproject. | Nov 1, 2022 | Dec 22, 2021 |
| Ubuntu | — | Upgrade libpj2 (Ubuntu Pro)Upgrade libpjsua2 (Ubuntu Pro)Upgrade libpjsip2 (Ubuntu Pro)Upgrade jami-daemonUpgrade ring-daemonUpgrade libpjnath2 (Ubuntu Pro)Upgrade ring (Ubuntu Pro)Upgrade ring-daemon (Ubuntu Pro)Upgrade libpjmedia2 (Ubuntu Pro)Upgrade python-pjproject (Ubuntu Pro)Upgrade ringUpgrade jami | Oct 10, 2023 | Dec 22, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub