CVE-2021-43299
Stack overflow in PJSUA API when calling pjsua_player_create. An attac ...
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk, ring | 1:16.28.0~dfsg-0+deb10u1 et 1 autres |
| debian 11 | asterisk, ring | 1:16.28.0~dfsg-0+deb11u1 et 1 autres |
Afficher les 23 entrées de 20 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u1 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
| debian 12 | ring | 20230206.0~ds1-1 |
| debian 14 | asterisk | 1:18.11.1~dfsg+~cs6.10.40431413-1 |
| debian 9 | pjproject | 2.5.5~dfsg-6+deb9u3 |
| echo | ring | 20230206.0~ds1-1 |
| ubuntu 16.04-ESM | pjproject | 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | pjproject | 2.7.2~dfsg-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | ring | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
| ubuntu 20.04 | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
Références
- https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://ubuntu.com/security/notices/USN-6422-1
- https://ubuntu.com/security/notices/USN-8122-1
- https://www.cve.org/CVERecord?id=CVE-2021-43299