PT-2022-1913 · Pjsip+4 · Pjsip+4

Published 2022-02-16 · Updated 2026-03-24 · CVE-2021-43301

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PJSIP (affected versions not specified)

Description The issue is related to a stack overflow in the PJSUA API when calling the pjsua playlist create function. An attacker-controlled file names argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. This can allow a remote attacker to execute arbitrary code. The vulnerability is associated with a boundary error in the PJSUA API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-01449

CVE-2021-43301

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-QCVW-H34V-C7R9

USN-6422-1

USN-8122-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Red Os

Ubuntu

References · 62

• https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2021-43301 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43301 · Security Note
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21722 · Vendor Advisory