debian/ring vulnerabilities

Latest debian/ring CVEs

Newest publication first · page 1 of 2

1. DSA-5956-1 ring - security update

   Published 2025-07-03

   Unknown

2. DLA-3887-1 ring - security update

   Published 2024-09-14

   Unknown

3. CVE-2023-38703 PJSIP has use-after-free vulnerability in SRTP media transport

   Published 2023-10-06

   Critical·CVSS 9.8 EPSS 1.6%

   PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level tr...

4. DLA-3549-1 ring - security update

   Published 2023-08-29

   Unknown

5. CVE-2023-27585 PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't a...

   Published 2023-03-14

   High·CVSS 7.5 EPSS 2.3%

   PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is r...

6. CVE-2022-23547 Heap buffer overflow in pjproject when decoding STUN message

   Published 2022-12-23

   Critical·CVSS 9.8 EPSS 1.0%

   PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The...

7. CVE-2022-23537 PJSIP vulnerable to heap buffer overflow when decoding STUN message

   Published 2022-12-20

   Critical·CVSS 9.8 EPSS 1.1%

   PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerabi...

8. CVE-2022-39269 Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip

   Published 2022-10-06

   Critical·CVSS 9.1 EPSS 0.73%

   PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts al...

9. CVE-2022-39244 Buffer overflow in pjlib scanner and pjmedia

   Published 2022-10-06

   Critical·CVSS 9.8 EPSS 1.5%

   PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This...

10. CVE-2022-31031 Potential stack buffer overflow when parsing message as a STUN client

    Published 2022-06-07

    Critical·CVSS 9.8 EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use ST...

11. CVE-2022-24792 Potential infinite loop when parsing WAV format file in PJSIP

    Published 2022-04-25

    High·CVSS 7.5 EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chu...

12. CVE-2022-24793 Potential heap buffer overflow when parsing DNS packets in PJSIP

    Published 2022-04-06

    High·CVSS 7.5 EPSS 2.2%

    PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is rela...

13. CVE-2022-24786 Potential out-of-bound read/write in PJSIP

    Published 2022-04-06

    Critical·CVSS 9.8 EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A p...

14. CVE-2022-24763 Infinite Loop in PJSIP

    Published 2022-03-30

    High·CVSS 7.5 EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known w...

15. CVE-2022-24764 Stack buffer overflow in pjproject

    Published 2022-03-22

    High·CVSS 7.5 EPSS 2.4%

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API pjmedia_sdp_print(), pjmedia_sdp_media_print(). Applications that do not use P...

16. CVE-2022-24754 Buffer overflow in pjsip

    Published 2022-03-11

    Critical·CVSS 9.8 EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type PJS...

17. CVE-2022-23608 Use after free in PJSIP

    Published 2022-02-22

    Critical·CVSS 9.8 EPSS 4.0%

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multipl...

18. CVE-2021-43303 Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overfl...

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 2.4%

    Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied

19. CVE-2021-43302 Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.

    Published 2022-02-16

    Critical·CVSS 9.1 EPSS 2.2%

    Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.

20. CVE-2021-43301 Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any siz...

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 2.4%

    Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

21. CVE-2021-43300 Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size....

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 2.4%

    Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

22. CVE-2021-43299 Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size va...

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 2.5%

    Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

23. CVE-2022-21723 Out-of-bounds read in multipart parsing in PJSIP

    Published 2022-01-27

    Critical·CVSS 9.1 EPSS 4.4%

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potential...

24. CVE-2022-21722 Potential out-of-bound read during RTP/RTCP parsing in PJSIP

    Published 2022-01-27

    Critical·CVSS 9.1 EPSS 2.3%

    PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packet...

25. CVE-2021-43845 Prevent out-of-bounds read in PJSIP

    Published 2021-12-27

    Critical·CVSS 9.1 EPSS 3.9%

    PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.