CVE-2021-37706
Publication date 22 December 2021
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
Status
Package | Ubuntu Release | Status |
---|---|---|
pjproject | 18.04 LTS bionic |
Needs evaluation
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of standard support | |
ring | 24.04 LTS noble | Not in release |
20.04 LTS focal |
Fixed 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
|
|
18.04 LTS bionic |
Fixed 20180228.1.503da2b~ds1-1ubuntu0.1~esm1
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Ignored end of standard support |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 · Critical |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-6422-1
- Ring vulnerabilities
- 9 October 2023
- USN-6422-2
- Ring vulnerabilities
- 24 October 2023