PT-2022-1916 · Pjsip+4 · Pjsip+4

Uriya Yavnieli · Published 2022-02-16 · Updated 2026-03-24 · CVE-2021-43299

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PJSIP (affected versions not specified)

Description The issue is related to a stack overflow in the PJSUA API when calling the pjsua player create function. An attacker-controlled filename argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. This could allow a remote attacker to execute arbitrary code on the target system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-01452

CVE-2021-43299

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-QCVW-H34V-C7R9

USN-6422-1

USN-8122-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Red Os

Ubuntu

References · 63

• https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-43299 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01452 · Security Note
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43299 · Security Note
• https://osv.dev/vulnerability/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory