CVE-2023-38703

Description

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.

How to fix CVE-2023-38703

To remediate CVE-2023-38703, upgrade the affected package to a fixed version below.

• —upgrade to 2.14-r0 or later
• —upgrade to 1:16.28.0~dfsg-0+deb11u4 or later
• —no fix listed

Is CVE-2023-38703 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 2.14-r0
• from 0, < 1:16.28.0~dfsg-0+deb11u4
• from 0

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2023-38703
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-38703