CVE-2022-39244: 
NixOS vulnerability analysis and mitigation

PJSIP, a free and open source multimedia communication library, was found to contain a buffer overflow vulnerability (CVE-2022-39244) affecting the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser. The vulnerability was discovered and disclosed in October 2022, affecting versions 2.12.1 and lower (GitHub Advisory).

The vulnerability stems from insufficient boundary checks in the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser components. The issue was addressed in version 2.13 and later through commit c4d34984 which implemented proper boundary checking mechanisms and buffer overflow protections (GitHub Commit). The vulnerability is classified as Moderate severity and is associated with CWE-119 (Buffer Overflow).

Users connecting to untrusted clients are at risk of potential buffer overflow attacks. This vulnerability could potentially lead to denial of service or arbitrary code execution in affected applications (NVD, GitHub Advisory).

The recommended mitigation is to upgrade to PJSIP version 2.13 or later, which contains the security fix. The patch is available as commit c4d34984 in the master branch (GitHub Advisory, Gentoo Security).