CVE-2015-2003

CRITICAL

PJSIP PJSUA2 SDK <51322 - Code Injection

Title source: llm

Description

The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References (2)

[Third Party Advisory] https://alephsecurity.com/vulns/aleph-2015004

[Technical Description, Third Party Advisory] https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf

Scores

CVSS v3 9.8

EPSS 0.0109

EPSS Percentile 77.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-118

Status published

Affected Products (1)

pjsip/pjsua2_sdk < 51322

Timeline

Published Mar 29, 2018

Tracked Since Feb 18, 2026