Skip to content
OpenAdvisories
High · 7.5 CVE-2022-24792 EUVD-2022-29600

Potential infinite loop when parsing WAV format file in PJSIP

Published Apr 25, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Description

PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.

Affected products

VendorProductAffectedFixed
pjsip pjproject <= 2.12 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 —
Debian 12 ring 20230206.0~ds1-1 —
Debian 11 asterisk 1:16.28.0~dfsg-0+deb11u1 DSA-5285-1
Debian 10 asterisk 1:16.28.0~dfsg-0+deb10u1 DLA-3194-1
Debian 9 pjproject 2.5.5~dfsg-6+deb9u5 DLA-3036-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 asterisk No fix yet —
Ubuntu 26.04 LTS asterisk No fix yet —
Ubuntu 25.10 asterisk No fix yet —
Ubuntu 24.04 LTS asterisk No fix yet —
Ubuntu 22.04 LTS asterisk No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS ring +1 No fix yet —
Ubuntu 18.04 LTS asterisk No fix yet —
Ubuntu Pro 18.04 LTS ring +1 No fix yet —
Ubuntu Pro 16.04 LTS asterisk +1 No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 pjproject 2.12.1-r0 —
Alpine v3.23 pjproject 2.12.1-r0 —
Alpine v3.22 pjproject 2.12.1-r0 —
Alpine v3.21 pjproject 2.12.1-r0 —
Alpine v3.20 pjproject 2.12.1-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 pjproject 2.12.1-r0 —
Alpine v3.18 pjproject 2.12.1-r0 —
Alpine v3.17 pjproject 2.12.1-r0 —
Alpine v3.16 pjproject 2.12.1-r0 —

Advisories 3

References