Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.

Affected: Ubuntu:Pro:16.04:LTS: pjproject, Ubuntu:Pro:18.04:LTS: pjproject

Youngsung Kim discovered that PJSIP did not properly parse numeric header fields in SIP messages. A remote attacker could use this issue to cause PJSIP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-16872)

Peter Koletzki discovered that PJSIP did not properly handle certain connection requests. A remote attacker could possibly use this issue to cause PJSIP to enter an unrecoverable state and reject further connections, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-16875)

Alfred Farrugia, Sandro Gauci, and Kevin Harwell discovered that PJSIP did not properly parse certain SDP messages. A remote attacker could possibly use this issue to cause PJSIP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1000098, CVE-2018-1000099)

Lauri Vänskä discovered that PJSIP did not verify hostnames when reusing TLS connections. If a remote attacker were able to intercept communication, this flaw could possibly be exploited to view sensitive information. (CVE-2020-15260)

It was discovered that PJSIP did not properly handle certain sequences of SDP messages. A remote attacker could possibly use this issue to cause PJSIP to crash, resulting in a denial of service. (CVE-2021-21375)

It was discovered that the SSL socket implementation in PJSIP contained a race condition. A remote attacker could possibly use this issue to…