Search for vulnerabilities
Vulnerability details: VCID-62ba-n9sh-cfc9
Vulnerability ID VCID-62ba-n9sh-cfc9
Aliases CVE-2023-38703
Summary PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-416 Use After Free
System Score Found at
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2023-38703
cvssv3.1 9.8 https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d
ssvc Track https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d
cvssv3.1 9.8 https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
ssvc Track https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-38703
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-38703
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37457
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38703
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49294
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49786
1059303 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059303
6dc9b8c181aff39845f02b4626e0812820d4ef0d https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*
CVE-2023-38703 https://nvd.nist.gov/vuln/detail/CVE-2023-38703
GHSA-f76w-fh7c-pc66 https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
msg00019.html https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-09-19T18:46:16Z/ Found at https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-09-19T18:46:16Z/ Found at https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-09-19T18:46:16Z/ Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-38703
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.58737
EPSS Score 0.00381
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:39:41.859776+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.20/main.json 37.0.0