Skip to content
OpenAdvisories
Unscored CVE-2017-16875 EUVD-2017-8049GHSA-qw72-xqg4-c435

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unreg…

Published Nov 17, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Description

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 9 pjproject 2.5.5~dfsg-6+deb9u1 DSA-4170-1
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS pjproject 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1 —

Advisories 1

References