PJSIP Out-of-Bounds Heap Read Vulnerability in SIP Multipart Parsing

A cascading out-of-bounds heap read vulnerability has been identified in PJSIP versions through 2.16, within the function 'pjsip_multipart_parse()'. The issue arises after the function matches boundary strings; the pointer 'curptr' is moved past the delimiter without checking if it has reached the end of the buffer. This oversight allows adjacent bytes of heap memory to be read. Applications that handle incoming SIP messages with multipart bodies or SDP content may be affected.

Impact

Exploitation of this vulnerability leads to a moderate severity out-of-bounds heap read, allowing for the reading of 1-2 bytes from adjacent heap memory, which could potentially be leveraged in a heap exploitation scenario.

Remediation

Users can upgrade to PJSIP version 2.17, where this vulnerability has been patched.