PJSIP vulnerabilities

PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.

PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.

PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.

PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.

PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends copy DNS SubjectAltName values with string functions that recalculate their length and truncate an embedded NUL byte. With server verification enabled through --tls-verify-server, a certificate containing a DNS SubjectAltName formed from the target hostname prefix followed by an embedded NUL and an attacker-controlled suffix can be accepted for the prefix hostname.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.

PJSIP before commit 4472a31 has a stack buffer overflow in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. An overly long command line can overflow fixed-size buffers, potentially causing application termination. Only applications with the telnet CLI front-end enabled are affected.

In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.

PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.

PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.

In the PJSIP library before commit d6a0e7f, there is a buffer overflow in pjsip_generic_array_hdr_print() in sip_msg.c, which serializes generic array headers (e.g., Allow, Require, Supported). Under certain output-buffer boundary conditions, the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests, such as proxies, SBCs, or B2BUAs.

PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.

PJSIP prior to version 2.17, on GnuTLS builds, can accept SIP TLS transport (sip_transport_tls) connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE.

In PJSIP prior to version 2.16, Opus PLC may zero-fill the input frame according to the decoder ptime, while the input frame length based on stream ptime may be less than that. This affects PJSIP users using the Opus audio codec in the receiving direction and can lead to unexpected application termination due to a memory overwrite.