Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-38703

Use After Free

Published: Oct 06, 2023 | Modified: Apr 10, 2025
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-38703
CWEhttps://cwe.mitre.org/data/definitions/416.html

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (PJMEDIA_HAS_SRTP is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

NameVendorStart VersionEnd Version
PjsipTeluu*2.13.1 (including)
AsteriskUbuntubionic*
AsteriskUbuntufocal*
AsteriskUbuntulunar*
AsteriskUbuntumantic*
AsteriskUbuntuoracular*
AsteriskUbuntuplucky*
AsteriskUbuntutrusty*
AsteriskUbuntuxenial*
RingUbuntubionic*
RingUbuntufocal*
RingUbuntulunar*
RingUbuntumantic*
RingUbuntutrusty*
RingUbuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use