CVE-2022-24792

Name	CVE-2022-24792
Description	PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3036-1, DLA-3194-1, DSA-5285-1
Debian Bugs	1014976

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	forky, sid	1:22.10.1+dfsg+~cs6.17.60671434-1	fixed
ring (PTS)	bookworm, bookworm (security)	20230206.0~ds2-1.1+deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
asterisk	source	stretch	(not affected)
asterisk	source	buster	1:16.28.0~dfsg-0+deb10u1		DLA-3194-1
asterisk	source	bullseye	1:16.28.0~dfsg-0+deb11u1		DSA-5285-1
asterisk	source	(unstable)	1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1			1014976
pjproject	source	stretch	2.5.5~dfsg-6+deb9u5		DLA-3036-1
pjproject	source	(unstable)	(unfixed)
ring	source	(unstable)	20230206.0~ds1-1	unimportant

Notes

[stretch] - asterisk <not-affected> (Vulnerable code not present)
code is present in ring but ring only uses the pjsip code, not pjmedia
https://github.com/pjsip/pjproject/security/advisories/GHSA-rwgw-vwxg-q799
https://github.com/pjsip/pjproject/commit/947bc1ee6d05be10204b918df75a503415fd3213
should only affect 32bit builds.