CVE-2021-43299: Buffer Overflow
Stack overflow in PJSUA API when calling pjsuaplayercreate. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20180228.1.503 - Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20190215.1. - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-43299?
CVE-2021-43299 is a vulnerability that allows a stack overflow in PJSUA API when calling pjsua_player_create.
What is the severity of CVE-2021-43299?
CVE-2021-43299 has a severity rating of 9.8 (Critical).
Which software is affected by CVE-2021-43299?
CVE-2021-43299 affects Teluu Pjsip versions up to and including 2.11.1, as well as Debian Linux versions 9.0, 10.0, and 11.0.
How does CVE-2021-43299 occur?
CVE-2021-43299 occurs when an attacker-controlled 'filename' argument is passed to pjsua_player_create, causing a buffer overflow.
How can I fix CVE-2021-43299?
To fix CVE-2021-43299, update to the latest version of Teluu Pjsip or Debian Linux, depending on the affected software.