Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24764: pjproject stack overflow can crash calling apps

CVE-2022-24764 · published 4 years ago

Summary

Versions of the pjproject library up to 2.12 can overrun memory when certain functions are used, which may cause the application to crash or behave unexpectedly. This mainly affects software that uses the PJSUA2 interface or calls the pjmedia_sdp_print or pjmedia_sdp_media_print functions, such as Ring, Asterisk, and other products that rely on pjproject. Update to the latest code from the official repository to apply the fix; there are no reliable work‑arounds at present.

What to do

Update canonical ring to version 20180228.1.503da2b~ds1-1ubuntu0.1~esm1.
Update canonical ring to version 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1.
Update debian asterisk to version 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1.
Update debian ring to version 20230206.0~ds1-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:16.04:LTS	canonical	pjproject	All versions
Ubuntu:Pro:18.04:LTS	canonical	pjproject	All versions
Ubuntu:Pro:18.04:LTS	canonical	ring	< 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 Fix: upgrade to 20180228.1.503da2b~ds1-1ubuntu0.1~esm1
Ubuntu:20.04:LTS	canonical	ring	< 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 Fix: upgrade to 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
–	teluu	pjsip	<= 2.12 `cpe:2.3:a:teluu:pjsip::::::::`
–	debian	debian_linux	9.0 10.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`
Debian:14	debian	asterisk	< 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 Fix: upgrade to 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1
Debian:12	debian	ring	< 20230206.0~ds1-1 Fix: upgrade to 20230206.0~ds1-1

Original advisory text

Stack buffer overflow in pjproject

PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

References

https://ubuntu.com/security/CVE-2022-24764 Third Party Advisory
https://ubuntu.com/security/notices/USN-6422-1 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2022-24764 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24764... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-24764 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html URL
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html Third Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m Vendor Advisory
https://security.gentoo.org/glsa/202210-37 Vendor Advisory
https://www.debian.org/security/2022/dsa-5285 Vendor Advisory
https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b... Patch
https://security-tracker.debian.org/tracker/CVE-2022-24764 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-120Classic Buffer Overflow

CWE-121Stack-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published22 Mar 2022

Updated3 Nov 2026

First seen25 Mar 2026

Sources

UBUNTU-CVE-2022-24764 · OSV

CVE-2022-24764 · OSV

GHSA-f5qg-pqcg-765m · GHSA

CVE-2022-24764 · NVD

DEBIAN-CVE-2022-24764 · OSV

Track software like this

Free during beta