CVE & CISA-KEV Catalog

CVE-2021-37706

HIGHEPSS 91th pctl
7.3
CVSS v3
NVD

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

CWE-191

How to fix

Remediation Available
asteriskDebian
Fixed in:1:16.28.0~dfsg-0+deb11u1CVE-2021-37706
Fixed in:1:18.10.1~dfsg+~cs6.10.40431411-1CVE-2021-37706
jamiUbuntu
Fixed in:20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1USN-6422-1
Fixed in:20230206.0~ds1-5ubuntu0.1USN-6422-1
Fixed in:20230206.0~ds2-1.3ubuntu0.1USN-6422-2
jami-daemonUbuntu
Fixed in:20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1USN-6422-1
Fixed in:20230206.0~ds1-5ubuntu0.1USN-6422-1
Fixed in:20230206.0~ds2-1.3ubuntu0.1USN-6422-2
libpj2Ubuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
libpjmedia2Ubuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
libpjnath2Ubuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
libpjsip2Ubuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
libpjsua2Ubuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
pjprojectUbuntu
Fixed in:2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1USN-8122-1
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
python-pjprojectUbuntu
Fixed in:2.7.2~dfsg-1ubuntu0.1~esm1USN-8122-1
ringUbuntu
Fixed in:20180228.1.503da2b~ds1-1ubuntu0.1~esm1USN-6422-1
Fixed in:20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1USN-6422-1
Fixed in:20230206.0~ds1-5ubuntu0.1USN-6422-1
Fixed in:20230206.0~ds2-1.3ubuntu0.1USN-6422-2
ring-daemonUbuntu
Fixed in:20180228.1.503da2b~ds1-1ubuntu0.1~esm1USN-6422-1
Fixed in:20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1USN-6422-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityLow
IntegrityLow
AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploit Intelligence

4.62%probability of exploitation in 30 days
91stpercentile

High risk: more likely to be exploited than 91% of all known CVEs.

References

Embed a live status badge for CVE-2021-37706
CVE-2021-37706 severity badge

Markdown

[![CVE-2021-37706](https://tridentstack.com/cve/badge/CVE-2021-37706.svg)](https://tridentstack.com/cve/CVE-2021-37706)

HTML

<a href="https://tridentstack.com/cve/CVE-2021-37706"><img src="https://tridentstack.com/cve/badge/CVE-2021-37706.svg" alt="CVE-2021-37706"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-11-04.