← Vulnerability feed

Vulnerability record · CVE-2023-27585 · published 14 March 2023

CVE-2023-27585: Teluu pjsip classic buffer overflow vulnerability

Teluu · Pjsip

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

7.5 CVSS 3.1 High EPSS 2.3% · top 17.2% CWE-120 · Classic buffer overflowCWE-122 · Heap-based buffer overflow
7.5CVSS 3.1 base score
2.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
15References
17 Jun 2026Last modified by NVD

Description

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5 Patch
https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4 Vendor Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr PatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00020.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
https://www.debian.org/security/2023/dsa-5438
https://www.pjsip.org/pjlib-util/docs/html/group__PJ__DNS__RESOLVER.htm Product
https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5 Patch
https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4 Vendor Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr PatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00020.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
https://www.debian.org/security/2023/dsa-5438
https://www.pjsip.org/pjlib-util/docs/html/group__PJ__DNS__RESOLVER.htm Product

Track CVE-2023-27585 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-38703Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is …EPSS 1.3%9.8CVE-2022-23537Teluu pjsip heap-based buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 1.1%9.8CVE-2022-31031Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 2.0%9.8CVE-2022-24754Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stac…EPSS 2.1%9.8CVE-2022-23608Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 4.0%9.8CVE-2021-43303Teluu pjsip classic buffer overflow vulnerabilityBuffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an o…EPSS 2.4%9.8CVE-2021-43301Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is …EPSS 2.4%9.8CVE-2021-43299Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copi…EPSS 2.5%

Source: NIST National Vulnerability Database (record CVE-2023-27585), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.