Buffer overflow in pjproject (Debian package) - CVE-2017-16872
Published: April 10, 2018 / Updated: April 12, 2018
Vulnerability identifier: #VU11773
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16872
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error when parsing the numeric header fields in a SIP message. A remote attacker can use specially crafted invalid values, trigger buffer overflow and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
pjproject (Debian package)
pjproject (Ubuntu package)
Debian Linux
Ubuntu
pjproject (Ubuntu package)
Debian Linux
Ubuntu
How to mitigate CVE-2017-16872
Update to versions 2.5.5~dfsg-6+deb9u1 or 2.7.2~dfsg-1.
pjproject (Ubuntu package) - addressed in versions 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1, 2.7.2~dfsg-1ubuntu0.1~esm1