CVE-2022-24764
Summary
| CVE | CVE-2022-24764 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-22 17:15:00 UTC |
| Updated | 2023-08-30 01:15:00 UTC |
| Description | PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds. |
Risk And Classification
Problem Types: CWE-120 | CWE-121
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Teluu | Pjsip | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 2962-1] pjproject security update | MLIST | lists.debian.org | |
| Potential stack buffer overflow when printing SDP into a buffer · Advisory · pjsip/pjproject · GitHub | CONFIRM | github.com | |
| PJSIP: Multiple Vulnerabilities (GLSA 202210-37) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] [DLA 3549-1] ring security update | MLIST | lists.debian.org | |
| Debian -- Security Information -- DSA-5285-1 asterisk | DEBIAN | www.debian.org | |
| Merge pull request from GHSA-f5qg-pqcg-765m · pjsip/pjproject@560a134 · GitHub | MISC | github.com | |
| [SECURITY] [DLA 3194-1] asterisk security update | MLIST | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179161 Debian Security Update for pjproject (DLA 2962-1)
- 181225 Debian Security Update for asterisk (DLA 3194-1)
- 181237 Debian Security Update for asterisk (DSA 5285-1)
- 182976 Debian Security Update for ring (CVE-2022-24764)
- 199817 Ubuntu Security Notification for Ring Vulnerabilities (USN-6422-1)
- 502232 Alpine Linux Security Update for pjproject
- 504293 Alpine Linux Security Update for pjproject
- 6000045 Debian Security Update for ring (DLA 3549-1)
- 710674 Gentoo Linux PJSIP Multiple Vulnerabilities (GLSA 202210-37)