Asterisk@* Security Vulnerabilities and Issues — Asterisk@* CVE List

Lucene search

DigiumAsterisk*

8 matches found

CVE•added 2019/07/12 8:15 p.m.•376 views

CVE-2019-13161

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an...

5.3CVSS5.3AI score0.02285EPSS

CVE•added 2019/07/12 8:15 p.m.•344 views

CVE-2019-12827

Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.

6.5CVSS5.6AI score0.19587EPSS

CVE•added 2019/11/22 6:15 p.m.•295 views

CVE-2019-18610

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syst...

9CVSS8.5AI score0.43014EPSS

CVE•added 2019/09/09 9:15 p.m.•205 views

CVE-2019-15297

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

6.5CVSS6.1AI score0.0114EPSS

CVE•added 2019/11/22 5:15 p.m.•158 views

CVE-2019-18790

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls ...

6.5CVSS6.5AI score0.07418EPSS

CVE•added 2019/09/09 1:15 p.m.•98 views

CVE-2019-15639

main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.

7.5CVSS7.3AI score0.088EPSS

CVE•added 2019/11/22 5:15 p.m.•97 views

CVE-2019-18976

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

7.5CVSS7.4AI score

CVE•added 2019/03/28 5:29 p.m.•88 views

CVE-2019-7251

An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

6.5CVSS6AI score0.04411EPSS