PJSIP has use-after-free vulnerability in SRTP media transport

CVE-2023-38703

What is CVE-2023-38703?

The PJSIP multimedia communication library has revealed a vulnerability related to the synchronization between its higher-level SRTP transport and lower-level media transports, which may lead to a use-after-free condition. This issue primarily affects applications leveraging SRTP capabilities that do not utilize UDP as their underlying transport. Exploitation of this vulnerability could result in unexpected application termination or potentially allow for control flow hijacking and memory corruption. Developers are urged to review the available patch and update their implementations accordingly.

References