PT-2022-1914 · Pjsip+4 · Pjsip+4

Uriya Yavnieli · Published 2022-02-16 · Updated 2026-03-24 · CVE-2021-43303

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PJSIP (affected versions not specified)

Description The issue is related to a buffer overflow in the PJSUA API when calling the pjsua call dump function. An attacker-controlled buffer argument may cause a buffer overflow if an output buffer smaller than 128 characters is supplied, regardless of the maxlen argument. This could allow a remote attacker to execute arbitrary code. The vulnerability is associated with a boundary error in the PJSUA API, potentially leading to memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-01450

CVE-2021-43303

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-QCVW-H34V-C7R9

USN-6422-1

USN-8122-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Red Os

Ubuntu

References · 61

• https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 · Patch
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43303 · Security Note
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01450 · Security Note
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21722 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory