Debian LTS: Security Advisory for pjproject (DLA-3036-1)

The remote host is missing an update for the 'pjproject' package(s) announced via the DLA-3036-1 advisory.

Multiple security issues were discovered in pjproject, is a free and open source multimedia communication library CVE-2022-24763 a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. CVE-2022-24792 A denial-of-service vulnerability affects applications on a 32-bit systems to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files CVE-2022-24793 A buffer overflow vulnerability affects applications that uses PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver.

'pjproject' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 2.5.5~dfsg-6+deb9u5. We recommend that you upgrade your pjproject packages.