PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
References
Configurations
History
21 Nov 2024, 08:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d - Patch | |
| References | () https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66 - Patch, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html - |
29 Dec 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Oct 2023, 22:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66 - Patch, Vendor Advisory | |
| References | (MISC) https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d - Patch | |
| CPE | cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* | |
| First Time |
Teluu pjsip
Teluu |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
06 Oct 2023, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-06 14:15
Updated : 2024-11-21 08:14
NVD link : CVE-2023-38703
Mitre link : CVE-2023-38703
CVE.ORG link : CVE-2023-38703
JSON object : View
Products Affected
teluu
- pjsip
CWE
CWE-416
Use After Free