Search for vulnerabilities
Vulnerability details: VCID-st6j-2kt9-aaak
Vulnerability ID VCID-st6j-2kt9-aaak
Aliases CVE-2022-39244
Summary PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00164 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
epss 0.00776 https://api.first.org/data/v1/epss?cve=CVE-2022-39244
cvssv3.1 7.5 https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
ssvc Track https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
cvssv3.1 7.5 https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
ssvc Track https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-39244
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-39244
cvssv3.1 7.5 https://security.gentoo.org/glsa/202210-37
ssvc Track https://security.gentoo.org/glsa/202210-37
cvssv3.1 7.5 https://www.debian.org/security/2023/dsa-5358
ssvc Track https://www.debian.org/security/2023/dsa-5358
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-39244
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23537
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23547
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31031
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37325
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39244
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39269
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42705
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42706
https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
https://security.gentoo.org/glsa/202210-37
https://www.debian.org/security/2023/dsa-5358
cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*
CVE-2022-39244 https://nvd.nist.gov/vuln/detail/CVE-2022-39244
USN-6422-1 https://usn.ubuntu.com/6422-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-39244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-39244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202210-37
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://security.gentoo.org/glsa/202210-37
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2023/dsa-5358
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:20Z/ Found at https://www.debian.org/security/2023/dsa-5358
Exploit Prediction Scoring System (EPSS)
Percentile 0.34066
EPSS Score 0.00164
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.