Teluu Pjsip any version

Potential integer underflow upon receiving STUN message in PJSIP

Use after free in PJSIP

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.

Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied

Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

Buffer overflow in pjsip

Potential stack buffer overflow when parsing message as a STUN client

PJSIP has use-after-free vulnerability in SRTP media transport

PJSIP vulnerable to heap buffer overflow when decoding STUN message

Out-of-bounds read in multipart parsing in PJSIP

Prevent out-of-bounds read in PJSIP

Potential out-of-bound read during RTP/RTCP parsing in PJSIP

Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.

PJSIP: Stack overflow parsing SDP a=crypto attributes

Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip

PJSIP: Heap OOB read in VPX unpacketizer

PJSIP: SIP Multipart CID URI Length Underflow

PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend

PJSIP: Stack overflow handling Service-Route headers in a registration response

PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

PJSIP: Heap overflow in the HTTP client

GnuTLS backend silently skips certificate chain verification when verify_peer is false

PJSIP: Asymmetric ptime integer overflow in Media Stream

Missing release of locks in PJSIP

Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.

Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.

Stack buffer overflow in pjproject

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

Out-of-bounds read when parsing RTCP BYE message in PJSIP

Infinite Loop in PJSIP

Potential infinite loop when parsing WAV format file in PJSIP

PJSIP: SIP message header buffer overflow

Existing TLS connections can be reused without checking remote hostname

Crash in receiving updated SDP answer after initial SDP negotiation failed

PJSIP: Pre-authentication overflow in the telnet CLI error

PJSIP: Pre-authentication overflow in the telnet CLI history

Denial of Service in PJSIP