CVE-2022-24764: Stack buffer overflow in pjproject
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API pjmediasdpprint(), pjmediasdpmediaprint(). Applications that do not use PJSUA2 and do not directly call pjmediasdpprint() or pjmediasdpmediaprint() should not be affected. A patch is available on the master branch of the pjsip/pjproject GitHub repository. There are currently no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24764?
CVE-2022-24764 is a stack buffer overflow vulnerability in PJSIP versions 2.12 and prior.
Who is affected by CVE-2022-24764?
Users of PJSUA2 library or users calling the API pjmedia_sdp_print(), pjmedia_sdp_media_print() are affected by CVE-2022-24764.
What is the severity of CVE-2022-24764?
The severity of CVE-2022-24764 is high, with a severity value of 7.5.
How can I fix CVE-2022-24764?
To fix CVE-2022-24764, it is recommended to update to a version of PJSIP that is later than 2.12.
What are the references for CVE-2022-24764?
The references for CVE-2022-24764 include: [1] https://security-tracker.debian.org/tracker/CVE-2022-24764, [2] https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m, [3] https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00