Advisories · Technology
asterisk.
Every CVE that names asterisk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 6.9 Medium
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
- asterisk
- certified-asterisk
- CWE-426
- CVSS 7.0 High
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- asterisk
- certified-asterisk
- SQL injection
- CVSS 8.2 High
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 6.0 Medium
Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 7.5 High
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
- asterisk
- certified-asterisk
- CWE-839
- CVSS 7.5 High
Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- asterisk
- certified-asterisk
- Path traversal
- Broken access control
- CVSS 7.5 High
Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 8.1 High
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- asterisk
- certified-asterisk
- Privilege escalation
- CWE-1220
- CVSS 7.1 High
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 2.3 Low
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 7.5 High
Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 5.9 Medium
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 2.3 Low
Asterisk: Possible RED T.140 Heap Buffer Overflow
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 6.5 Medium
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
- asterisk
- certified-asterisk
- CWE-126
- CWE-170
- CVSS 7.7 High
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 6.3 Medium
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- asterisk
- certified-asterisk
- Memory corruption
- CVSS 6.9 Medium
Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- asterisk
- certified-asterisk
- Other injection
- CVSS 7.1 High
Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- asterisk
- certified-asterisk
- Memory corruption
- CWE-664
- CVSS 2.3 Low
Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
- asterisk
- certified-asterisk
- Cross-site scripting (XSS)
- CVSS 0.0 None
ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
- asterisk
- CWE-427
- CVSS 0.0 None
Asterisk vulnerable to potential privilege escalation
- asterisk
- CWE-427
- CVSS 2.0 Low
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
- asterisk
- XML external entities (XXE)
- CVSS 3.5 Low
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
- asterisk
- Cross-site scripting (XSS)
- CVSS 7.0 High
Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
- Asterisk
- CWE-427
- CVSS 7.5 High
Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
- asterisk
- CWE-253
- CVSS 6.5 Medium
Asterisk remotely exploitable leak of RTP UDP ports and internal resources
- asterisk
- Denial of service
- CWE-1286
- CVSS 6.5 Medium
Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation
- asterisk
- Memory corruption
- CVSS 4.8 Medium
cli_permissions.conf: deny option does not work for disallowing shell commands
- asterisk
- Command injection
- CVSS 7.7 High
Using malformed From header can forge identity with ";" or NULL in name portion
- asterisk
- CWE-140
- CWE-792
- CVSS 5.7 Medium
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
- asterisk
- Memory corruption
- CWE-252
- CVSS 7.4 High
Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
- asterisk
- Privilege escalation
- CWE-1220
- CVSS 5.8 Medium
Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests
- asterisk
- Authentication bypass
- CWE-480
- CVSS 7.5 High
Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
- asterisk
- CWE-703
- CVSS 7.5 High
Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'
- asterisk
- Memory corruption
- CVSS 4.9 Medium
Asterisk Path Traversal vulnerability
- asterisk
- Path traversal
-
asterisk allows calls on prohibited networks
- asterisk