Out-of-bounds write in pjsip - #VU159278

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by crashing an application using PJSIP.

The vulnerability exists due to an out-of-bounds write in the PJMEDIA jitter buffer when an empty jitter buffer zero-fills a codec frame larger than the audio stream's decoding buffer. A remote attacker can place a call that the application accepts and that negotiates an enabled codec with an oversized frame, such as L16/44100/2, then send no media to trigger a write past the decoding buffer into the stream's encoder state and crash the application.

Affected software

Remediation

External References

• https://github.com/pjsip/pjproject/security/advisories/GHSA-x72w-9h98-h8gr

Related Security Bulletins

• Multiple vulnerabilities in pjsip