Lucene search

DebianDEBIAN:DLA-3036-1:E47F1

HistoryMay 31, 2022 - 9:08 a.m.

[SECURITY] [DLA 3036-1] pjproject security update

2022-05-3109:08:35

lists.debian.org

debian lts

pjproject

security update

denial-of-service

buffer overflow

multimedia communication

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.5

Confidence

High

EPSS

0.004

Percentile

74.5%

JSON

Debian LTS Advisory DLA-3036-1 [email protected]
https://www.debian.org/lts/security/ Abhijith PA
May 31, 2022 https://wiki.debian.org/LTS

Package : pjproject
Version : 2.5.5~dfsg-6+deb9u5
CVE ID : CVE-2022-24763 CVE-2022-24792 CVE-2022-24793

Multiple security issues were discovered in pjproject, is a free and
open source multimedia communication library

CVE-2022-24763

a denial-of-service vulnerability that affects PJSIP users that 
consume PJSIP&#x27;s XML parsing in their apps.

CVE-2022-24792

A denial-of-service vulnerability affects applications on a 32-bit 
systems to play/read invalid WAV files. The vulnerability occurs 
when reading WAV file data chunks with length greater than 31-bit 
integers. The vulnerability does not affect 64-bit apps and should 
not affect apps that only plays trusted WAV files

CVE-2022-24793

A buffer overflow vulnerability affects applications that uses 
PJSIP DNS resolution. It doesn&#x27;t affect PJSIP users who utilize an 
external resolver.

For Debian 9 stretch, these problems have been fixed in version
2.5.5~dfsg-6+deb9u5.

We recommend that you upgrade your pjproject packages.

For the detailed security status of pjproject please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pjproject

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11ppc64elasterisk-ooh323-dbgsym< 1:16.28.0~dfsg-0+deb11u1asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_ppc64el.deb
Debian10i386asterisk-mobile< 1:16.28.0~dfsg-0+deb10u1asterisk-mobile_1:16.28.0~dfsg-0+deb10u1_i386.deb
Debian9i386libpjsua2-2v5< 2.5.5~dfsg-6+deb9u5libpjsua2-2v5_2.5.5~dfsg-6+deb9u5_i386.deb
Debian9armhflibpjsua2-2v5< 2.5.5~dfsg-6+deb9u5libpjsua2-2v5_2.5.5~dfsg-6+deb9u5_armhf.deb
Debian11mipselasterisk-ooh323-dbgsym< 1:16.28.0~dfsg-0+deb11u1asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_mipsel.deb
Debian11amd64asterisk-voicemail-imapstorage< 1:16.28.0~dfsg-0+deb11u1asterisk-voicemail-imapstorage_1:16.28.0~dfsg-0+deb11u1_amd64.deb
Debian11s390xasterisk-mysql-dbgsym< 1:16.28.0~dfsg-0+deb11u1asterisk-mysql-dbgsym_1:16.28.0~dfsg-0+deb11u1_s390x.deb
Debian11armelasterisk-voicemail-imapstorage< 1:16.28.0~dfsg-0+deb11u1asterisk-voicemail-imapstorage_1:16.28.0~dfsg-0+deb11u1_armel.deb
Debian11s390xasterisk-tests-dbgsym< 1:16.28.0~dfsg-0+deb11u1asterisk-tests-dbgsym_1:16.28.0~dfsg-0+deb11u1_s390x.deb
Debian11mips64elasterisk-ooh323-dbgsym< 1:16.28.0~dfsg-0+deb11u1asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	ppc64el	asterisk-ooh323-dbgsym	< 1:16.28.0~dfsg-0+deb11u1	asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_ppc64el.deb
Debian	10	i386	asterisk-mobile	< 1:16.28.0~dfsg-0+deb10u1	asterisk-mobile_1:16.28.0~dfsg-0+deb10u1_i386.deb
Debian	9	i386	libpjsua2-2v5	< 2.5.5~dfsg-6+deb9u5	libpjsua2-2v5_2.5.5~dfsg-6+deb9u5_i386.deb
Debian	9	armhf	libpjsua2-2v5	< 2.5.5~dfsg-6+deb9u5	libpjsua2-2v5_2.5.5~dfsg-6+deb9u5_armhf.deb
Debian	11	mipsel	asterisk-ooh323-dbgsym	< 1:16.28.0~dfsg-0+deb11u1	asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_mipsel.deb
Debian	11	amd64	asterisk-voicemail-imapstorage	< 1:16.28.0~dfsg-0+deb11u1	asterisk-voicemail-imapstorage_1:16.28.0~dfsg-0+deb11u1_amd64.deb
Debian	11	s390x	asterisk-mysql-dbgsym	< 1:16.28.0~dfsg-0+deb11u1	asterisk-mysql-dbgsym_1:16.28.0~dfsg-0+deb11u1_s390x.deb
Debian	11	armel	asterisk-voicemail-imapstorage	< 1:16.28.0~dfsg-0+deb11u1	asterisk-voicemail-imapstorage_1:16.28.0~dfsg-0+deb11u1_armel.deb
Debian	11	s390x	asterisk-tests-dbgsym	< 1:16.28.0~dfsg-0+deb11u1	asterisk-tests-dbgsym_1:16.28.0~dfsg-0+deb11u1_s390x.deb
Debian	11	mips64el	asterisk-ooh323-dbgsym	< 1:16.28.0~dfsg-0+deb11u1	asterisk-ooh323-dbgsym_1:16.28.0~dfsg-0+deb11u1_mips64el.deb