[From nobody Fri Jun 26 19:23:02 2026 Received: (at submit) by bugs.debian.org; 25 Apr 2026 11:06:22 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-4.7 required=4.0 tests=BAYES_00, FOURLA, MD5_SHA1_SUM, MURPHY_DRUGS_REL6,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 122; hammy, 150; neutral, 259; spammy, 0. spammytokens: hammytokens:0.000-+--UD:security-tracker.debian.org, 0.000-+--securitytrackerdebianorg, 0.000-+--security-tracker.debian.org, 0.000-+--H*r:jmm, 0.000-+--sk:team@se Return-path: <jmm@inutil.org> Received: from inutil.org ([51.38.114.215]:52836 helo=vps-b7ad3695.vps.ovh.net) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <jmm@inutil.org>) id 1wGaq5-000SN9-33 for submit@bugs.debian.org; Sat, 25 Apr 2026 11:06:22 +0000 Received: from soju.westfalen.local (p548dc5fc.dip0.t-ipconnect.de [84.141.197.252]) by vps-b7ad3695.vps.ovh.net (Postfix) with ESMTPSA id E204E1F7 for <submit@bugs.debian.org>; Sat, 25 Apr 2026 11:06:20 +0000 (UTC) Received: from jmm by soju.westfalen.local with local (Exim 4.99.1) (envelope-from <jmm@soju.westfalen.local>) id 1wGaok-00000003YPc-1MEb for submit@bugs.debian.org; Sat, 25 Apr 2026 13:04:58 +0200 Date: Sat, 25 Apr 2026 13:04:58 +0200 To: submit@bugs.debian.org Subject: asterisk: CVE-2025-65102 CVE-2026-25994 CVE-2026-41415 CVE-2026-40614 CVE-2026-40892 CVE-2026-41416 CVE-2026-26203 CVE-2026-26967 CVE-2026-32942 CVE-2026-28799 CVE-2026-29068 CVE-2026-32945 CVE-2026-33069 CVE-2026-34235 Message-ID: <aeyf2nMMztyfJRWi@pisco.westfalen.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline From: =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= <jmm@inutil.org> Delivered-To: submit@bugs.debian.org Source: asterisk X-Debbugs-CC: team@security.debian.org Severity: grave Tags: security Hi, Multiple security issues were reported against pjsip and fixed in 2.17. Asterisk bundles 2.16 in unstable: CVE-2025-65102[0]: | PJSIP is a free and open source multimedia communication library. | Prior to version 2.16, Opus PLC may zero-fill the input frame as | long as the decoder ptime, while the input frame length, which is | based on stream ptime, may be less than that. This issue affects | PJSIP users who use the Opus audio codec in receiving direction. The | vulnerability can lead to unexpected application termination due to | a memory overwrite. This issue has been patched in version 2.16. CVE-2026-25994[1]: | PJSIP is a free and open source multimedia communication library | written in C. In 2.16 and earlier, a buffer overflow vulnerability | exists in PJNATH ICE Session when processing credentials with | excessively long usernames. CVE-2026-41415[2]: | PJSIP is a free and open source multimedia communication library | written in C. In 2.16 and earlier, there is an out-of-bounds read | when parsing a malformed Content-ID URI in SIP multipart message | body. Insufficient length validation can cause reads beyond the | intended buffer bounds. This vulnerability is fixed in 2.17. CVE-2026-40614[3]: | PJSIP is a free and open source multimedia communication library | written in C. In 2.16 and earlier, there is a buffer overflow when | decoding Opus audio frames due to insufficient buffer size | validation in the Opus codec decode path. The FEC decode buffers | (dec_frame[].buf) were allocated based on a PCM-derived formula: | (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields | only 960 bytes, but codec_parse() can output encoded frames up to | MAX_ENCODED_PACKET_SIZE (1280) bytes via | opus_repacketizer_out_range(). The three pj_memcpy() calls in | codec_decode() copied input->size bytes without bounds checking, | causing a heap buffer overflow. CVE-2026-40892[4]: | PJSIP is a free and open source multimedia communication library | written in C. In 2.16 and earlier, a stack buffer overflow exists in | pjsip_auth_create_digest2() in PJSIP when using pre-computed digest | credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential | data using cred_info->data.slen as the length without an upper-bound | check, which can overflow the fixed-size ha1 stack buffer (128 | bytes) if data.slen exceeds the expected digest string length. CVE-2026-41416[5]: | PJSIP is a free and open source multimedia communication library | written in C. In 2.16 and earlier, there is an integer overflow in | media stream buffer size calculation when processing SDP with | asymmetric ptime configuration. The overflow may result in an | undersized buffer allocation, which can lead to unexpected | application termination or memory corruption This vulnerability is | fixed in 2.17. CVE-2026-26203[6]: | PJSIP is a free and open source multimedia communication library. | Versions prior to 2.17 have a critical heap buffer underflow | vulnerability in PJSIP's H.264 packetizer. The bug occurs when | processing malformed H.264 bitstreams without NAL unit start codes, | where the packetizer performs unchecked pointer arithmetic that can | read from memory located before the allocated buffer. Version 2.17 | contains a patch for the issue. CVE-2026-26967[7]: | PJSIP is a free and open source multimedia communication library | written in C. In versions 2.16 and below, there is a critical Heap- | based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. | The bug occurs when processing malformed SRTP packets, where the | unpacketizer reads a 2-byte NAL unit size field without validating | that both bytes are within the payload buffer bounds. The | vulnerability affects applications that receive video using H.264. A | patch is available at https://github.com/pjsip/pjproject/commit/f821 | c214e52b11bae11e4cd3c7f0864538fb5491. CVE-2026-32942[8]: | PJSIP is a free and open source multimedia communication library | written in C. Versions 2.16 and below contain a heap use-after-free | vulnerability in the ICE session that occurs when there are race | conditions between session destruction and the callbacks. This issue | has been fixed in version 2.17. CVE-2026-28799[9]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to version 2.17, a heap use-after-free | vulnerability exists in PJSIP's event subscription framework | (evsub.c) that is triggered during presence unsubscription | (SUBSCRIBE with Expires=0). This issue has been patched in version | 2.17. CVE-2026-29068[10]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to version 2.17, there is a stack buffer | overflow vulnerability when pjmedia-codec parses an RTP payload | contain more frames than the caller-provided frames can hold. This | issue has been patched in version 2.17. CVE-2026-32945[11]: | PJSIP is a free and open source multimedia communication library | written in C. Versions 2.16 and below have a Heap-based Buffer | Overflowvulnerability in the DNS parser's name length handler. | Thisimpacts applications using PJSIP's built-in DNS resolver, such | as those configured with pjsua_config.nameserver or | UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who | rely on the OS resolver (e.g., getaddrinfo()) by not configuring a | nameserver, or those using an external resolver via | pjsip_resolver_set_ext_resolver(). This issue is fixed in version | 2.17. For users unable to upgrade, a workaround is to disable DNS | resolution in the PJSIP config (by setting nameserver_count to zero) | or to use an external resolver implementation instead. CVE-2026-33069[12]: | PJSIP is a free and open source multimedia communication library | written in C. Versions 2.16 and below have a cascading out-of-bounds | heap read in pjsip_multipart_parse(). After boundary string | matching, curptr is advanced past the delimiter without verifying it | has not reached the buffer end. This allows 1-2 bytes of adjacent | heap memory to be read. All applications that process incoming SIP | messages with multipart bodies or SDP content are potentially | affected. This issue is resolved in version 2.17. CVE-2026-34235[13]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to version 2.17, a heap out-of-bounds read | vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs | when parsing crafted VP9 Scalability Structure (SS) data. | Insufficient bounds checking on the payload descriptor length may | cause reads beyond the allocated RTP payload buffer. This issue has | been patched in version 2.17. A workaround for this issue involves | disabling VP9 codec if not needed. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-65102 https://www.cve.org/CVERecord?id=CVE-2025-65102 [1] https://security-tracker.debian.org/tracker/CVE-2026-25994 https://www.cve.org/CVERecord?id=CVE-2026-25994 [2] https://security-tracker.debian.org/tracker/CVE-2026-41415 https://www.cve.org/CVERecord?id=CVE-2026-41415 [3] https://security-tracker.debian.org/tracker/CVE-2026-40614 https://www.cve.org/CVERecord?id=CVE-2026-40614 [4] https://security-tracker.debian.org/tracker/CVE-2026-40892 https://www.cve.org/CVERecord?id=CVE-2026-40892 [5] https://security-tracker.debian.org/tracker/CVE-2026-41416 https://www.cve.org/CVERecord?id=CVE-2026-41416 [6] https://security-tracker.debian.org/tracker/CVE-2026-26203 https://www.cve.org/CVERecord?id=CVE-2026-26203 [7] https://security-tracker.debian.org/tracker/CVE-2026-26967 https://www.cve.org/CVERecord?id=CVE-2026-26967 [8] https://security-tracker.debian.org/tracker/CVE-2026-32942 https://www.cve.org/CVERecord?id=CVE-2026-32942 [9] https://security-tracker.debian.org/tracker/CVE-2026-28799 https://www.cve.org/CVERecord?id=CVE-2026-28799 [10] https://security-tracker.debian.org/tracker/CVE-2026-29068 https://www.cve.org/CVERecord?id=CVE-2026-29068 [11] https://security-tracker.debian.org/tracker/CVE-2026-32945 https://www.cve.org/CVERecord?id=CVE-2026-32945 [12] https://security-tracker.debian.org/tracker/CVE-2026-33069 https://www.cve.org/CVERecord?id=CVE-2026-33069 [13] https://security-tracker.debian.org/tracker/CVE-2026-34235 https://www.cve.org/CVERecord?id=CVE-2026-34235 Please adjust the affected versions in the BTS as needed. ]