PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects appl...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record parse_query(), while the issue in CVE-2022-24793 is in parse_rr(). A patch is available as commit d1c5e4d in the master branch. A workaround is to disable DNS resolution in PJSIP config (by setting nameserver_count to zero) or use an external resolver implementation instead.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-27585 pjproject Corrigé dans: 2.13.1-r0
- Debian DEBIAN-CVE-2023-27585 asterisk Corrigé dans: 1:16.28.0~dfsg-0+deb11u3
Références
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- patch github.com
- web lists.debian.org
- web pjsip.org
- web lists.debian.org
- web lists.debian.org