PT-2021-6170 · Pjsip+3 · Pjsip+3

Highsauwming · Published 2020-07-06 · Updated 2026-03-24 · CVE-2021-37706

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP (affected versions not specified)

Description The issue is related to an integer underflow scenario when processing a STUN message with an ERROR-CODE attribute. This can be exploited by a malicious actor located within the victim's network, who may forge and send a specially crafted UDP (STUN) message to remotely execute arbitrary code on the victim's machine. The problem affects all users that use STUN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2020-2313

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-01086

CVE-2021-37706

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-2QPG-F6WF-W984

USN-6422-1

USN-6422-2

USN-8122-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Ubuntu

References · 63

• https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865 · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984 · Patch
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37706 · Security Note
• https://ubuntu.com/security/CVE-2021-43299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37706 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37706 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-37706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23608 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24793 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01086 · Security Note
• http://seclists.org/fulldisclosure/2022/Mar/0 · Patch
• https://ubuntu.com/security/CVE-2022-24764 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5285-1 · Vendor Advisory