Asymmetric denial of service In pjproject
Description
PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the master branch of the pjsip/project GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.21 | 2.12.1-r0 | ||
 debian 12 | 20230206.0~ds1-1 | ||
alpine v3.16 | 2.12.1-r0 | ||
alpine v3.17 | 2.12.1-r0 | ||
alpine v3.18 | 2.12.1-r0 | ||
alpine v3.19 | 2.12.1-r0 | ||
alpine v3.20 | 2.12.1-r0 | ||
alpine v3.22 | 2.12.1-r0 | ||
alpine v3.23 | 2.12.1-r0 | ||
alpine v3.24 | 2.12.1-r0 |
1-10 of 11
10
Aliases