6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
9 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
71.3%
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the master
branch. There are no known workarounds.
[
{
"vendor": "pjsip",
"product": "pjproject",
"versions": [
{
"version": "<= 2.11.1",
"status": "affected"
}
]
}
]
github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a
github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
lists.debian.org/debian-lts-announce/2022/03/msg00035.html
lists.debian.org/debian-lts-announce/2022/11/msg00021.html
lists.debian.org/debian-lts-announce/2023/08/msg00038.html
security.gentoo.org/glsa/202210-37
www.debian.org/security/2022/dsa-5285
More
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
9 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
71.3%