PT-2017-14609 · Teluu+1 · Pjsip+1

Published 2017-11-17 · Updated 2026-03-24 · CVE-2017-16872

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.7.1

Description An issue was discovered in the parsing of numeric header fields in a SIP message, such as cseq, ttl, and port. This could lead to a buffer overflow, causing unintended values to be captured or a buffer overrun if the values are converted back to strings. A potential exploit could utilize carefully crafted invalid values.

Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of numeric header fields in SIP messages to minimize the risk of exploitation. Avoid using the affected pjlib and pjlib-util components in Teluu pjproject until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-3676

CVE-2017-16872

DSA-4170-1

USN-8122-1

Affected Products

Alt Linux

Pjsip

References · 26

• https://nvd.nist.gov/vuln/detail/CVE-2017-16872 · Security Note
• https://trac.pjsip.org/repos/ticket/2056 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43300 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37706 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16872 · Vendor Advisory
• https://trac.pjsip.org/repos/milestone/release-2.7.1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16875 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16872 · Security Note
• https://ubuntu.com/security/CVE-2021-43303 · Vendor Advisory