CVE-2022-24764
Published on: Not Yet Published
Last Modified on: 02/02/2023 06:30:00 PM UTC
Certain versions of Debian Linux from Debian contain the following vulnerability:
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
- CVE-2022-24764 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: pjsip - pjproject version <= 2.12
CVSS3 Score: 7.5 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | NONE | HIGH |
CVSS2 Score: 5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| NONE | NONE | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| [SECURITY] [DLA 2962-1] pjproject security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20220328 [SECURITY] [DLA 2962-1] pjproject security update |
| Potential stack buffer overflow when printing SDP into a buffer · Advisory · pjsip/pjproject · GitHub | github.com text/html |
CONFIRM github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m |
| PJSIP: Multiple Vulnerabilities (GLSA 202210-37) — Gentoo security | security.gentoo.org text/html |
GENTOO GLSA-202210-37 |
| Debian -- Security Information -- DSA-5285-1 asterisk | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5285 |
| Merge pull request from GHSA-f5qg-pqcg-765m · pjsip/[email protected] · GitHub | github.com text/html |
MISC github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00 |
| [SECURITY] [DLA 3194-1] asterisk security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update |
Related QID Numbers
Exploit/POC from Github
This repository contains a collection of data files on known Common Vulnerabilities and Exposures (CVEs). Each file i…
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Teluu | Pjsip | All | All | All | All |
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2022-24764 : PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and p… twitter.com/i/web/status/1… | 2022-03-22 16:34:08 |
 /r/netcve |
CVE-2022-24764 | 2022-03-22 17:38:44 |