CVE-2017-16872: Buffer Overflow
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16872?
CVE-2017-16872 is an issue discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before version 2.7.1, which can cause overflow in numeric header fields in a SIP message, leading to unintended values.
What is the severity of CVE-2017-16872?
CVE-2017-16872 has a severity rating of 9.8 (Critical).
How does CVE-2017-16872 affect Teluu pjproject?
CVE-2017-16872 affects Teluu pjproject (pjlib and pjlib-util) versions prior to 2.7.1.
How does CVE-2017-16872 affect Debian Debian Linux?
CVE-2017-16872 affects Debian Debian Linux version 9.0.
Is there a fix available for CVE-2017-16872?
Yes, upgrading to Teluu pjproject 2.7.1 or later resolves the vulnerability.