Multiple Vulnerabilities in PJSIP

PJSIP, a widely used open-source multimedia communication library, is vulnerable to multiple security flaws including heap buffer overflows and integer overflows (CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495). These vulnerabilities stem from improper processing of incoming SIP messages. An unauthenticated remote attacker can exploit these flaws by sending specially crafted SIP packets to an application utilizing the affected PJSIP versions. Successful exploitation may result in unauthorized data manipulation, information disclosure, or a denial-of-service (DoS) state, where the affected service crashes or becomes unresponsive. Versions prior to 2.14.1 are confirmed to be vulnerable. Defenders should prioritize updating instances of PJSIP to version 2.14.1 or later to mitigate these risks.

Impact

Successful exploitation of these vulnerabilities allows an unauthenticated remote attacker to disrupt communication services via a denial-of-service, or potentially gain control over the affected application through memory corruption. PJSIP is integrated into numerous VoIP, unified communications, and softphone products, making this impact widespread across organizations relying on real-time communication infrastructure.

Recommendation

• Patch all instances of PJSIP by upgrading to version 2.14.1 or later to address CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495.
• Audit network logs for anomalous SIP traffic or malformed packets directed toward VoIP infrastructure and softphone services.
• Review vendor-specific advisories for any proprietary products that bundle PJSIP, as they may require product-specific patches beyond the library update.