Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
156 results · page 2 of 4
Apr 25, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24792 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24793 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24786 · Other software · pjsip · reported by GitHubCritical 9.8
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022PJSIP is a free and open source multimedia communication library written in the C language.CVE-2022-24763 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24764 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022PJSIP is a free and open source multimedia communication library written in C language.CVE-2022-24754 · Other software · pjsip · reported by GitHubHigh 8.5
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-23608 · Other software · pjsip · reported by GitHubHigh 8.1
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 16, 2022Buffer overflow in PJSUA API when calling pjsua_call_dump.CVE-2021-43303 · Other software · teluu · reported by reefs@jfrog.comCritical 9.8
Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied
- Product
- pjsip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 16, 2022Read out-of-bounds in PJSUA API when calling pjsua_recorder_create.CVE-2021-43302 · Other software · teluu · reported by reefs@jfrog.comCritical 9.1
Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.
- Product
- pjsip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 16, 2022Stack overflow in PJSUA API when calling pjsua_playlist_create.CVE-2021-43301 · Other software · teluu · reported by reefs@jfrog.comCritical 9.8
Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
- Product
- pjsip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 16, 2022Stack overflow in PJSUA API when calling pjsua_recorder_create.CVE-2021-43300 · Other software · teluu · reported by reefs@jfrog.comCritical 9.8
Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
- Product
- pjsip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 16, 2022Stack overflow in PJSUA API when calling pjsua_player_create.CVE-2021-43299 · Other software · teluu · reported by reefs@jfrog.comCritical 9.8
Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
- Product
- pjsip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 27, 2022Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.CVE-2021-46507 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.CVE-2021-46506 · Other software · Jsish · reported by MITREMedium 5.5
There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.CVE-2021-46505 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022There is an Assertion 'vp != resPtr' failed at jsiEval.c in Jsish v3.5.0.CVE-2021-46504 · Other software · Jsish · reported by MITREMedium 5.5
There is an Assertion 'vp != resPtr' failed at jsiEval.c in Jsish v3.5.0.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732.CVE-2021-46503 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d.CVE-2021-46502 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via SortSubCmd in src/jsiArray.c.CVE-2021-46501 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via SortSubCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ArgTypeCheck in src/jsiFunc.c.CVE-2021-46500 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ArgTypeCheck in src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueCopyMove in src/jsiValue.c.CVE-2021-46499 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueCopyMove in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_wswebsocketObjFree in src/jsiWebSocket.c.CVE-2021-46498 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_wswebsocketObjFree in src/jsiWebSocket.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_UserObjDelete in src/jsiUserObj.c.CVE-2021-46497 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_UserObjDelete in src/jsiUserObj.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_ObjFree in src/jsiObj.c.CVE-2021-46496 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_ObjFree in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via DeleteTreeValue in src/jsiObj.c.CVE-2021-46495 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via DeleteTreeValue in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueLookupBase in src/jsiValue.c.CVE-2021-46494 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueLookupBase in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_FunctionInvoke at src/jsiFunc.c.CVE-2021-46492 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_FunctionInvoke at src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c.CVE-2021-46491 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via NumberConstructor at src/jsiNumber.c.CVE-2021-46490 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via NumberConstructor at src/jsiNumber.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_DecrRefCount in src/jsiValue.c.CVE-2021-46489 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_DecrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArrayConcatCmd at src/jsiArray.c.CVE-2021-46488 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArrayConcatCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e506.CVE-2021-46487 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e506. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArraySpliceCmd at src/jsiArray.c.CVE-2021-46486 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArraySpliceCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_ValueIsNumber at src/jsiValue.c.CVE-2021-46485 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_ValueIsNumber at src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_IncrRefCount in src/jsiValue.c.CVE-2021-46484 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_IncrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-21723 · Other software · pjsip · reported by GitHubCritical 9.1
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 26, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-21722 · Other software · pjsip · reported by GitHubCritical 9.1
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.CVE-2021-46483 · Other software · Jsish · reported by MITREHigh 7.8
Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.CVE-2021-46482 · Other software · Jsish · reported by MITREHigh 7.8
Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.CVE-2021-46481 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c.CVE-2021-46480 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c.CVE-2021-46478 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c.CVE-2021-46477 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c.CVE-2021-46475 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c.CVE-2021-46474 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.CVE-2021-46323 · Other software · Espruino · reported by MITREMedium 5.5
Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.
- Product
- Espruino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TUCVE-2021-41141 · Other software · pjsip · reported by GitHubMedium 5.9
PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function returns without releasing the currently held locks. This could result in a system deadlock, which cause a denial of service for the users. No release has yet been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users may need to manually apply the patch.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021PJSIP is a free and open source multimedia communication library.CVE-2021-43845 · Other software · pjsip · reported by GitHubHigh 8.2
PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2021-43804 · Other software · pjsip · reported by GitHubHigh 7.3
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2021-37706 · Other software · pjsip · reported by GitHubHigh 7.3
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.