{"kind": "product", "path": "vulns/debian-12/ring", "name": "ring", "product": "ring", "ecosystem": "Debian:12", "items": [{"id": "DSA-5956-1", "noindex": false, "published": "2025-07-03T00:00:00Z", "modified": "2026-03-09T02:10:00.245208Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/dsa-5956-1", "title": "ring - security update", "description": "ring - security update", "references": ["https://osv.dev/vulnerability/DSA-5956-1"], "fixes": ["20230206.0~ds2-1.1+deb12u1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2023-38703", "noindex": false, "published": "2023-10-06T13:46:54.238Z", "modified": "2025-02-13T17:02:32.006Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.0159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-38703", "title": "PJSIP has use-after-free vulnerability in SRTP media transport", "description": "PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The p", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66", "https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d", "https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html"], "fixes": [], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2023-27585", "noindex": false, "published": "2023-03-14T00:00:00.000Z", "modified": "2025-11-04T16:10:03.178Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02311, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27585", "title": "CVE-2023-27585", "description": "PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation in", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr", "https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4", "https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5"], "fixes": ["20230206.0~ds2-1.1+deb12u1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-23547", "noindex": false, "published": "2022-12-23T14:00:22.817Z", "modified": "2025-11-04T16:09:33.854Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.01026, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-23547", "title": "Heap buffer overflow in pjproject when decoding STUN message", "description": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7fr", "https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w", "https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-23537", "noindex": false, "published": "2022-12-20T18:50:45.398Z", "modified": "2025-11-04T16:09:32.908Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.01114, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-23537", "title": "PJSIP vulnerable to heap buffer overflow when decoding STUN message", "description": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w", "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1", "https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-39269", "noindex": false, "published": "2022-10-06T00:00:00.000Z", "modified": "2025-04-23T16:52:49.799Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00732, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-39269", "title": "Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip", "description": "PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg", "https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc", "https://security.gentoo.org/glsa/202210-37"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-39244", "noindex": false, "published": "2022-10-06T00:00:00.000Z", "modified": "2025-11-04T16:09:52.910Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.015, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-39244", "title": "Buffer overflow in pjlib scanner and pjmedia", "description": "PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj", "https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae", "https://security.gentoo.org/glsa/202210-37"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-31031", "noindex": false, "published": "2022-06-07T00:00:00.000Z", "modified": "2025-11-04T16:09:46.351Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.02036, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-31031", "title": "Potential stack buffer overflow when parsing message as a STUN client", "description": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj", "https://github.com/pjsip/pjproject/commit/450baca94f475345542c6953832650c390889202", "https://security.gentoo.org/glsa/202210-37"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24792", "noindex": false, "published": "2022-04-25T00:00:00.000Z", "modified": "2025-04-23T18:32:37.590Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02053, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24792", "title": " Potential infinite loop when parsing WAV format file in PJSIP", "description": "PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-rwgw-vwxg-q799", "https://github.com/pjsip/pjproject/commit/947bc1ee6d05be10204b918df75a503415fd3213", "https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24793", "noindex": false, "published": "2022-04-06T00:00:00.000Z", "modified": "2025-11-04T16:09:38.646Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24793", "title": "Potential heap buffer overflow when parsing DNS packets in PJSIP", "description": "PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolv", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4", "https://github.com/pjsip/pjproject/commit/9fae8f43accef8ea65d4a8ae9cdf297c46cfe29a", "https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24786", "noindex": false, "published": "2022-04-06T00:00:00.000Z", "modified": "2025-04-23T18:41:30.691Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.0205, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24786", "title": "Potential out-of-bound read/write in PJSIP", "description": "PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q", "https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508", "https://security.gentoo.org/glsa/202210-37"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24763", "noindex": false, "published": "2022-03-30T00:00:00.000Z", "modified": "2025-11-04T16:09:36.751Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02063, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24763", "title": "Infinite Loop in PJSIP", "description": "PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4", "https://github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a21", "https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24764", "noindex": false, "published": "2022-03-22T00:00:00.000Z", "modified": "2025-11-04T16:09:37.703Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02376, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24764", "title": "Stack buffer overflow in pjproject", "description": "PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m", "https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-24754", "noindex": false, "published": "2022-03-11T00:00:00.000Z", "modified": "2025-11-04T16:09:35.777Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.0208, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24754", "title": "Buffer overflow in pjsip", "description": "PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662", "https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-23608", "noindex": false, "published": "2022-02-22T00:00:00.000Z", "modified": "2025-11-04T16:09:34.819Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.04022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-23608", "title": "Use after free in PJSIP", "description": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca7516", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62", "https://github.com/pjsip/pjproject/commit/db3235953baa56d2fb0e276ca510fefca751643f", "http://seclists.org/fulldisclosure/2022/Mar/1"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-43303", "noindex": false, "published": "2022-02-16T00:00:00.000Z", "modified": "2025-11-04T16:09:23.740Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43303", "title": "CVE-2021-43303", "description": "Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html", "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-43302", "noindex": false, "published": "2022-02-16T00:00:00.000Z", "modified": "2025-11-04T16:09:22.782Z", "cvss": 9.1, "cvss_vector": "", "severity": "critical", "epss": 0.02179, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43302", "title": "CVE-2021-43302", "description": "Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html", "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-43301", "noindex": false, "published": "2022-02-16T00:00:00.000Z", "modified": "2025-11-04T16:09:21.847Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43301", "title": "CVE-2021-43301", "description": "Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html", "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-43300", "noindex": false, "published": "2022-02-16T00:00:00.000Z", "modified": "2025-11-04T16:09:20.885Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43300", "title": "CVE-2021-43300", "description": "Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html", "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-43299", "noindex": false, "published": "2022-02-16T00:00:00.000Z", "modified": "2025-11-04T16:09:19.878Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.02493, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-43299", "title": "CVE-2021-43299", "description": "Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9", "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html", "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"], "fixes": ["20230206.0~ds1-1"], "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "ring", "path": "vulns/debian-12/ring", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-03-09T02:10:00.245208Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}