CVE-2023-27585: Buffer Overflow
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record parsequery(), while the issue in CVE-2022-24793 is in parserr(). A patch is available as commit d1c5e4d in the master branch. A workaround is to disable DNS resolution in PJSIP config (by setting nameservercount to zero) or use an external resolver implementation instead.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-27585?
CVE-2023-27585 is a buffer overflow vulnerability in PJSIP DNS resolver affecting versions 2.13 and prior.
Who is affected by CVE-2023-27585?
Applications that use PJSIP DNS resolver version 2.13 and prior are affected by CVE-2023-27585.
How severe is CVE-2023-27585?
CVE-2023-27585 has a severity rating of 7.5 (high).
How can I fix CVE-2023-27585?
Updating to a version of PJSIP that is not affected by CVE-2023-27585 is recommended.
Where can I find more information about CVE-2023-27585?
More information about CVE-2023-27585 can be found at the following references: [1] [2] [3].