An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
| CVE | CVE-2017-16872 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| EPSS | 3.5% en 30 días (percentil 89) |
| CWE | CWE-119 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Productos afectados (catálogo NVD)
debian/debian_linuxteluu/pjsip