CVE-2022-39244
Buffer overflow in pjlib scanner and pjmedia
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Buffer overflow in pjlib scanner and pjmedia
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-39244- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2022-41764
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
EUVD-2022-41764- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-39244- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-39244
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
ALPINE-CVE-2022-39244- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Buffer overflow in pjlib scanner and pjmedia
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-39244- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39244
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
DEBIAN-CVE-2022-39244- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-39244
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
UBUNTU-CVE-2022-39244- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6422-1 No score
ring vulnerabilities
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37706)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723, CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031, CVE-2022-39244)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-27585)
- Record
USN-6422-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pjprojectAlpine:v3.18 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.19 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.20 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.21 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.22 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.23 |
before 2.13-r0 | 2.13-r0 |
pjprojectAlpine:v3.24 |
before 2.13-r0 | 2.13-r0 |
asteriskDebian:14 |
before 1:20.0.1~dfsg+~cs6.12.40431414-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:20.0.1~dfsg+~cs6.12.40431414-1 |
ringDebian:12 |
before 20230206.0~ds1-1 | 20230206.0~ds1-1 |
asteriskDebian:10 From an advisory covering 8 CVEs |
before 1:16.28.0~dfsg-0+deb10u2, plus listed versions 1:16.10.0~dfsg-11:16.12.0~dfsg-11:16.15.0~dfsg-11:16.15.1~dfsg-11:16.16.1~dfsg+~2.10-1 Show 15 moreShow less1:16.16.1~dfsg+~2.10-21:16.16.1~dfsg-11:16.16.1~dfsg-1~bpo10+11:16.16.1~dfsg-21:16.16.1~dfsg-31:16.16.1~dfsg-41:16.2.1~dfsg-11:16.2.1~dfsg-1+deb10u11:16.2.1~dfsg-1+deb10u21:16.2.1~dfsg-21:16.23.0~dfsg+~2.10-11:16.23.0~dfsg+~cs6.10.20220309-11:16.23.0~dfsg+~cs6.10.20220309-21:16.23.0~dfsg+~cs6.10.40431411-11:16.28.0~dfsg-0+deb10u1 |
1:16.28.0~dfsg-0+deb10u2 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ringDebian:10 From an advisory covering 20 CVEs |
before 20190215.1.f152c98~ds1-1+deb10u2, plus listed versions 20190215.1.f152c98~ds1-120190215.1.f152c98~ds1-1+deb10u1 |
20190215.1.f152c98~ds1-1+deb10u2 |
ringDebian:11 From an advisory covering 21 CVEs |
before 20210112.2.b757bac~ds1-1+deb11u1, plus listed versions 20210112.2.b757bac~ds1-1 |
20210112.2.b757bac~ds1-1+deb11u1 |
asteriskDebian:11 From an advisory covering 8 CVEs |
before 1:16.28.0~dfsg-0+deb11u2, plus listed versions 1:16.16.1~dfsg+~2.10-11:16.16.1~dfsg+~2.10-21:16.16.1~dfsg-11:16.16.1~dfsg-1+deb11u11:16.16.1~dfsg-1+deb11u1~bpo10+1 Show 8 moreShow less1:16.16.1~dfsg-21:16.16.1~dfsg-31:16.16.1~dfsg-41:16.23.0~dfsg+~2.10-11:16.23.0~dfsg+~cs6.10.20220309-11:16.23.0~dfsg+~cs6.10.20220309-21:16.23.0~dfsg+~cs6.10.40431411-11:16.28.0~dfsg-0+deb11u1 |
1:16.28.0~dfsg-0+deb11u2 |
asteriskUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:13.1.0~dfsg-1.1ubuntu31:13.1.0~dfsg-1.1ubuntu41:13.1.0~dfsg-1.1ubuntu4.11:13.1.0~dfsg-1.1ubuntu4.1+esm1 |
None known |
pjprojectUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.1.0.0.ast20130823-12.1.0.0.ast20130823-1+deb8u1build0.16.04.12.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1 |
None known |
asteriskUbuntu:18.04:LTS |
All versions, plus listed versions 1:13.17.2~dfsg-1ubuntu11:13.17.2~dfsg-2ubuntu11:13.18.1~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu21:13.18.3~dfsg-1ubuntu31:13.18.3~dfsg-1ubuntu4 |
None known |
pjprojectUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.6~dfsg-22.7~dfsg-12.7.1~dfsg-12.7.1~dfsg-1build12.7.2~dfsg-12.7.2~dfsg-1ubuntu0.1~esm1 |
None known |
ringUbuntu:Pro:18.04:LTS |
before 20180228.1.503da2b~ds1-1ubuntu0.1~esm1, plus listed versions 20170803.2.5fcfe3f~dfsg1-120171024.1.eadbdeb~ds1-120171129.2.cf5bbff~ds1-120171129.2.cf5bbff~ds1-220180119.1.9e06f94~ds1-1 Show 4 moreShow less20180119.1.9e06f94~ds1-320180222.1.7bffde2~ds2-220180228.1.503da2b~ds1-120180228.1.503da2b~ds1-1build1 |
20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
ringUbuntu:20.04:LTS |
before 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, plus listed versions 20190215.1.f152c98~ds1-120190215.1.f152c98~ds1-1build120190215.1.f152c98~ds1-1build2 |
20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
asteriskUbuntu:20.04:LTS |
All versions, plus listed versions 1:16.2.1~dfsg-2build21:16.2.1~dfsg-2build31:16.2.1~dfsg-2ubuntu1 |
None known |
asteriskUbuntu:22.04:LTS |
All versions, plus listed versions 1:16.16.1~dfsg-21:16.16.1~dfsg-41:16.16.1~dfsg-4build11:16.16.1~dfsg+~2.10-11:18.10.0~dfsg+~cs6.10.40431411-2 |
None known |
asteriskUbuntu:24.04:LTS |
All versions, plus listed versions 1:20.4.0~dfsg+~cs6.13.40431414-21:20.5.0~dfsg+~cs6.13.40431414-11:20.5.1~dfsg+~cs6.13.40431414-11:20.5.2~dfsg+~cs6.13.40431414-11:20.6.0~dfsg+~cs6.13.40431414-1 Show 4 moreShow less1:20.6.0~dfsg+~cs6.13.40431414-21:20.6.0~dfsg+~cs6.13.40431414-2build31:20.6.0~dfsg+~cs6.13.40431414-2build41:20.6.0~dfsg+~cs6.13.40431414-2build5 |
None known |
asteriskUbuntu:25.10 |
All versions, plus listed versions 1:22.2.0~dfsg+~cs6.15.60671435-21:22.3.0~dfsg+~cs6.15.60671435-11:22.4.1~dfsg+~cs6.15.60671435-11:22.4.1~dfsg+~cs6.15.60671435-21:22.5.1~dfsg+~cs6.15.60671435-11:22.5.2~dfsg+~cs6.15.60671435-1 |
None known |
asteriskUbuntu:26.10 |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-11:22.10.0+dfsg+~cs6.17.60671434-1ubuntu21:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3 |
None known |
asteriskUbuntu:26.04:LTS |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-1 |
None known |
ringUbuntu:Pro:18.04:LTS From an advisory covering 20 CVEs |
before 20180228.1.503da2b~ds1-1ubuntu0.1~esm1, plus listed versions 20170803.2.5fcfe3f~dfsg1-120171024.1.eadbdeb~ds1-120171129.2.cf5bbff~ds1-120171129.2.cf5bbff~ds1-220180119.1.9e06f94~ds1-1 Show 4 moreShow less20180119.1.9e06f94~ds1-320180222.1.7bffde2~ds2-220180228.1.503da2b~ds1-120180228.1.503da2b~ds1-1build1 |
20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
ringUbuntu:20.04:LTS From an advisory covering 20 CVEs |
before 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, plus listed versions 20190215.1.f152c98~ds1-120190215.1.f152c98~ds1-1build120190215.1.f152c98~ds1-1build2 |
20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39244 is a high vulnerability (CVSS 7.5) in Pjsip, published October 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in pjproject 2.13-r0.
References
github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
security.gentoo.org/glsa/202210-37
lists.debian.org/debian-lts-announce/2023/02/msg00029.html
debian.org/security/2023/dsa-5358
Show 27 moreShow less
security.alpinelinux.org/vuln/CVE-2022-39244
nvd.nist.gov/vuln/detail/CVE-2022-39244
security-tracker.debian.org/tracker/CVE-2022-39244
ubuntu.com/security/CVE-2022-39244
cve.org/CVERecord?id=CVE-2022-39244
Left out here: 210 versions. The JSON record has them.