CVE-2023-27585CWE-120CWE-122

PJSIP is a free and open source multimedia communication library written in C

High · published March 14, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
83.3
In the wild
Unconfirmed
What it is

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02311 · 83.3th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-122 · Heap-based Buffer Overflow
Published
2023-03-14T00:00Z
EPSS history
Timeline
  • 14 MAR 00:00Z
    PJSIP is a free and open source multimedia communication library written in C
    cvelistv5