From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id CA1D6158020 for ; Mon, 31 Oct 2022 20:30:01 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 46625E1026; Mon, 31 Oct 2022 20:26:40 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 404EAE0F20 for ; Mon, 31 Oct 2022 20:22:23 +0000 (UTC) Received: from glsamakerdev.dev.gentoo.org (unknown [140.211.166.165]) by smtp.gentoo.org (Postfix) with ESMTP id 72520340E6E for ; Mon, 31 Oct 2022 20:22:22 +0000 (UTC) Received: from [172.18.0.3] (unknown [172.18.0.3]) by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id 5FE6D8D1B0 for ; Mon, 31 Oct 2022 20:22:22 +0000 (-00) Subject: [gentoo-announce] [ GLSA 202210-37 ] PJSIP: Multiple Vulnerabilities Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="===============4361252868159708519==" From: glsamaker@gentoo.org To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Date: Mon, 31 Oct 2022 20:22:22 -0000 Message-ID: <166724774239.9.14245938871582381260@90bb6a0775af> X-Archives-Salt: 98247822-9941-4217-b103-47288764da75 X-Archives-Hash: 9ebe850909390fd6b9585cca36a43563 --===============4361252868159708519== Content-Type: text/plain; charset="utf-8" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202210-37 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PJSIP: Multiple Vulnerabilities Date: October 31, 2022 Bugs: #803614, #829894, #875863 ID: 202210-37 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in PJSIP, the worst of which could result in arbitrary code execution. Background ========== PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/pjproject < 2.12.1 >= 2.12.1 Description =========== Multiple vulnerabilities have been discovered in PJSIP. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All PJSIP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.12.1" References ========== [ 1 ] CVE-2021-32686 https://nvd.nist.gov/vuln/detail/CVE-2021-32686 [ 2 ] CVE-2021-37706 https://nvd.nist.gov/vuln/detail/CVE-2021-37706 [ 3 ] CVE-2021-41141 https://nvd.nist.gov/vuln/detail/CVE-2021-41141 [ 4 ] CVE-2021-43804 https://nvd.nist.gov/vuln/detail/CVE-2021-43804 [ 5 ] CVE-2021-43845 https://nvd.nist.gov/vuln/detail/CVE-2021-43845 [ 6 ] CVE-2022-21722 https://nvd.nist.gov/vuln/detail/CVE-2022-21722 [ 7 ] CVE-2022-21723 https://nvd.nist.gov/vuln/detail/CVE-2022-21723 [ 8 ] CVE-2022-23608 https://nvd.nist.gov/vuln/detail/CVE-2022-23608 [ 9 ] CVE-2022-24754 https://nvd.nist.gov/vuln/detail/CVE-2022-24754 [ 10 ] CVE-2022-24763 https://nvd.nist.gov/vuln/detail/CVE-2022-24763 [ 11 ] CVE-2022-24764 https://nvd.nist.gov/vuln/detail/CVE-2022-24764 [ 12 ] CVE-2022-24786 https://nvd.nist.gov/vuln/detail/CVE-2022-24786 [ 13 ] CVE-2022-24792 https://nvd.nist.gov/vuln/detail/CVE-2022-24792 [ 14 ] CVE-2022-24793 https://nvd.nist.gov/vuln/detail/CVE-2022-24793 [ 15 ] CVE-2022-31031 https://nvd.nist.gov/vuln/detail/CVE-2022-31031 [ 16 ] CVE-2022-39244 https://nvd.nist.gov/vuln/detail/CVE-2022-39244 [ 17 ] CVE-2022-39269 https://nvd.nist.gov/vuln/detail/CVE-2022-39269 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202210-37 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --===============4361252868159708519== Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmNgLn4ACgkQFMQkOaVy +9m4DRAA2IwrF0WseT2ia9jR5DO3355EYh7i+l0Blv4euBX37oytOGVhHGRdBXic Y+eUZP7aTfmiDTJt6tpLMhJ+x6ciYsOPi3HL4cJsEoLO/mSktFTGch8QYkvzAHlZ L4/laP+GdsJyCB1fJ0tAISvRaSjPlK7flf6xZWogrksZmhclKz9o8TXqkmUxdyM1 v0TOIVkE8P6EgJMUOgR8TkW0072UZGzoRFIEYvY5E+rTaiNUCE+JhFQCDAMagEy8 UDRQ0RI01ETkQ0Qh+682FHela4iOEw2BaUQtieNJcSTVFbdYGeqFWWKO6Lfl8s2W zH2GkQV3PC3lLVk33qGAhYxtlKU1p7xrZ1Ea1c7Erim3KZY/XAZC0YFC3nM8Q2RX L/6AqACRknHhllqUW6+w7CqJMTCgwK+Kyc8g/oLgxfwi0zw7oKJCYPjaCB9cRr2x c/A4cNGYzmMzdTkRWlqCho65T+mKbJCbP1I8xF2E192OiwAVPQSeEchZsqi666Dd CC5GBOVi4o5af0yUq9PCKBxtUtjXLYgmcBXt2JRyglZ2PVz9MSX850tV5mgif2Zb u84dTIF2Xi8npsk0yMH5AlE3vt+IdneHaunBB6H9GK0xyKigxo5FiyluhsZ+xZqe QDTq6ihJ8KaiKjXAqiX32y3ojcyjIBLd+4kVYByaf1vbQFniOao= =wQgj -----END PGP SIGNATURE----- --===============4361252868159708519==--