CVE-2022-24764

Name
CVE-2022-24764
Description
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00
CONFIRM https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m
MLIST https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
Third Party Advisory https://security.gentoo.org/glsa/202210-37
MLIST https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
DEBIAN https://www.debian.org/security/2022/dsa-5285
MLIST https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* pjsip >= None <= 2.12

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
pjproject 3.16-main 2.12.1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed