Skip to content
OpenAdvisories
Critical USN-6422-1 20 CVEs

ring vulnerabilities

Published Oct 9, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ring incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file,
a remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2021-37706)

It was discovered that Ring incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file,
a remote attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,
CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723,
CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754,
CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031,
CVE-2022-39244)

It was discovered that Ring incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file,
a remote attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)

It was discovered that Ring incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file,
a remote attacker could possibly use this issue to cause a denial of service.
(CVE-2023-27585)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ring 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ring 20180228.1.503da2b~ds1-1ubuntu0.1~esm1

Vulnerabilities 20

  • Critical 9.8
    CVE-2022-31031

    Potential stack buffer overflow when parsing message as a STUN client

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJ…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2022-21722

    Potential out-of-bound read during RTP/RTCP parsing in PJSIP

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain inc…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2022-21723

    Out-of-bounds read in multipart parsing in PJSIP

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed mu…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 8.5
    CVE-2022-24754

    Buffer overflow in pjsip

    PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentia…

    pjsip pjproject pjproject pjproject Debian Ubuntu Alpine
  • High 8.2
    CVE-2021-43845

    Prevent out-of-bounds read in PJSIP

    PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. Thi…

    pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  • High 8.1
    CVE-2022-23608

    Use after free in PJSIP

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash …

    pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-24763

    Infinite Loop in PJSIP

    PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update.…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-24764

    Stack buffer overflow in pjproject

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applica…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-24793

    Potential heap buffer overflow when parsing DNS packets in PJSIP

    PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This …

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-39244

    Buffer overflow in pjlib scanner and pjmedia

    PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clien…

    pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  • High 7.5
    CVE-2023-27585

    PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versi…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 7.3
    CVE-2021-37706

    Potential integer underflow upon receiving STUN message in PJSIP

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the he…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 7.3
    CVE-2021-43804

    Out-of-bounds read when parsing RTCP BYE message in PJSIP

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this dec…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-23537

    PJSIP vulnerable to heap buffer overflow when decoding STUN message

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown att…

    pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-23547

    Heap buffer overflow in pjproject when decoding STUN message

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a cert…

    pjsip pjproject asterisk pjproject Debian Ubuntu
  • Unscored —
    CVE-2021-43299

    Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a bu…

    teluu pjsip asterisk asterisk Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-43300

    Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a …

    teluu pjsip asterisk asterisk Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-43301

    Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause …

    teluu pjsip asterisk asterisk Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-43302

    Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may caus…

    teluu pjsip asterisk asterisk Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-43303

    Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer …

    teluu pjsip asterisk asterisk Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2021-37706
  • report
    https://ubuntu.com/security/CVE-2021-43299
  • report
    https://ubuntu.com/security/CVE-2021-43300
  • report
    https://ubuntu.com/security/CVE-2021-43301
  • report
    https://ubuntu.com/security/CVE-2021-43302
  • report
    https://ubuntu.com/security/CVE-2021-43303
  • report
    https://ubuntu.com/security/CVE-2021-43804
  • report
    https://ubuntu.com/security/CVE-2021-43845
  • report
    https://ubuntu.com/security/CVE-2022-21722
  • report
    https://ubuntu.com/security/CVE-2022-21723
  • report
    https://ubuntu.com/security/CVE-2022-23537
  • report
    https://ubuntu.com/security/CVE-2022-23547
  • report
    https://ubuntu.com/security/CVE-2022-23608
  • report
    https://ubuntu.com/security/CVE-2022-24754
  • report
    https://ubuntu.com/security/CVE-2022-24763
  • report
    https://ubuntu.com/security/CVE-2022-24764
  • report
    https://ubuntu.com/security/CVE-2022-24793
  • report
    https://ubuntu.com/security/CVE-2022-31031
  • report
    https://ubuntu.com/security/CVE-2022-39244
  • report
    https://ubuntu.com/security/CVE-2023-27585