cbcvebase.
CVE-2017-16872
published 2017-11-17

CVE-2017-16872: An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl…

PriorityP347critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.40%
87.3th percentile
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.

Affected

4 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
pjsippjproject>= 0 < 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm12.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1
pjsippjproject>= 0 < 2.7.2~dfsg-1ubuntu0.1~esm12.7.2~dfsg-1ubuntu0.1~esm1
teluupjsip< 2.7.12.7.1

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.