Описание
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 2.7.2~dfsg-1 |
| cosmic | not-affected | 2.7.2~dfsg-1 |
| devel | DNE | |
| disco | not-affected | 2.7.2~dfsg-1 |
| eoan | not-affected | 2.7.2~dfsg-1 |
| esm-apps-legacy/xenial | released | 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1 |
| esm-apps/bionic | not-affected | 2.7.2~dfsg-1 |
| esm-apps/xenial | released | 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was needed] |
Показывать по
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in P ...
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
ALT-PU-2018-3676: package `libpjsip` update to version 2.8-alt1
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3