CVE-2015-2003

CRITICAL 9.8CVE-2015-2003 · Published 29/03/2018 · updated 17/06/2026

In short

CVE-2015-2003 is a CRITICAL (CVSS 9.8) vulnerability affecting pjsua2 sdk (pjsip).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.6% of all vulnerabilities.
Fix: update to 51322 or later.

Package	Affected versions	Patched versions
pjsua2 sdk pjsip	`< 51322`	`51322`

Description

The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References

alephsecurity.com/vulns/aleph-2015004 · Third Party Advisory
usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf · Technical Description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free