Univention Bugzilla – Bug 46811
pjproject: Multiple issues (4.3)
Last modified: 2018-05-16 17:04:22 CEST
New Debian pjproject 2.5.5~dfsg-6+deb9u1 fixes: This update addresses the following issues: * CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages * CVE-2017-16875: Double key unregistration in ioqueue component * CVE-2018-1000098: Integer overflow in SDP parsing * CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations. Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2. Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2. An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
[4.3-0] 7829942fe5 Bug #46811: pjproject_2.5.5~dfsg-6+deb9u1
--- mirror/ftp/4.3/unmaintained/4.3-0/source/pjproject_2.5.5~dfsg-6.dsc +++ apt/ucs_4.3-0-errata4.3-0/source/pjproject_2.5.5~dfsg-6+deb9u1.dsc @@ -1,3 +1,16 @@ +2.5.5~dfsg-6+deb9u1 [Tue, 03 Apr 2018 10:02:31 +0200] Bernhard Schmidt <berni@debian.org>: + + [ Bernhard Schmidt ] + * Fix various security issues + - CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages + - CVE-2017-16875: Double key unregistration in ioqueue component + - CVE-2018-1000098: Integer overflow in SDP parsing + (also reported by the Asterisk project as AST-2018-002) + - CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing + (also reported by the Asterisk project as AST-2018-003) + * Fix resolution of DNS SRV targets that do not have an AAAA record + (Closes: #881362) + 2.5.5~dfsg-6 [Fri, 02 Jun 2017 08:59:42 +0200] Bernhard Schmidt <berni@debian.org>: [ Tzafrir Cohen ]
* No UCS specific patches * Comparison to previously shipped version ok * Binary package update Ok * Advisory adjusted: af36ddd000 | Sort CVEs
<http://errata.software-univention.de/ucs/4.3/67.html>