CVE catalog

CVE-2021-37706

ring: CVE-2021-37706

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
4.92% · Oct 25, 2026

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianringbookworm20230206.0~ds2-1.1+deb12u1fixed
Debianringbookworm-security20230206.0~ds2-1.1+deb12u1fixed
Alpinepjproject3.162.12-r0fixed
Alpinepjproject3.172.12-r0fixed
Alpinepjproject3.182.12-r0fixed
Alpinepjproject3.192.12-r0fixed
Alpinepjproject3.202.12-r0fixed
Alpinepjproject3.212.12-r0fixed
Alpinepjproject3.222.12-r0fixed
Alpinepjproject3.232.12-r0fixed
Alpinepjproject3.242.12-r0fixed
Ubunturingpro20170803.2.5fcfe3f~dfsg1-1vulnerable
Ubunturingpro20171024.1.eadbdeb~ds1-1vulnerable
Ubunturingpro20171129.2.cf5bbff~ds1-1vulnerable
Ubunturingpro20171129.2.cf5bbff~ds1-2vulnerable
Ubunturingpro20180119.1.9e06f94~ds1-1vulnerable
Ubunturingpro20180119.1.9e06f94~ds1-3vulnerable
Ubunturingpro20180222.1.7bffde2~ds2-2vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1build1vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1ubuntu0.1~esm1fixed
Ubunturing20.0420190215.1.f152c98~ds1-1vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1build1vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1build2vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1+deb10u2build0.20.04.1fixed
Ubuntupjprojectpro2.6~dfsg-2vulnerable
Ubuntupjprojectpro2.7~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1build1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1ubuntu0.1~esm1fixed
Ubunturingpro20170803.2.5fcfe3f~dfsg1-1vulnerable
Ubunturingpro20171024.1.eadbdeb~ds1-1vulnerable
Ubunturingpro20171129.2.cf5bbff~ds1-1vulnerable
Ubunturingpro20171129.2.cf5bbff~ds1-2vulnerable
Ubunturingpro20180119.1.9e06f94~ds1-1vulnerable
Ubunturingpro20180119.1.9e06f94~ds1-3vulnerable
Ubunturingpro20180222.1.7bffde2~ds2-2vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1build1vulnerable
Ubunturingpro20180228.1.503da2b~ds1-1ubuntu0.1~esm1fixed
Ubunturing20.0420190215.1.f152c98~ds1-1vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1build1vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1build2vulnerable
Ubunturing20.0420190215.1.f152c98~ds1-1+deb10u2build0.20.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianringsourcebookworm20230206.0~ds1-1not yet assignedNot reported[1014998]
Alpinepjprojectapk3.162.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.172.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.182.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.192.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.202.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.212.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.222.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.232.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Alpinepjprojectapk3.242.12-r0Not reportedALPINE-CVE-2021-37706Not reported
Ubunturingdebpro20180228.1.503da2b~ds1-1ubuntu0.1~esm1Not reportedUSN-6422-1Not reported
Ubunturingdeb20.0420190215.1.f152c98~ds1-1+deb10u2build0.20.04.1Not reportedUSN-6422-1Not reported
Ubuntupjprojectdebpro2.7.2~dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-37706Not reported
Ubunturingdebpro20180228.1.503da2b~ds1-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-37706Not reported
Ubunturingdeb20.0420190215.1.f152c98~ds1-1+deb10u2build0.20.04.1Not reportedUBUNTU-CVE-2021-37706Not reported

[Debian bug #1014998]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jami]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

  • [jami-daemon]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]