CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-15297 – Asterisk Project Security Advisory - AST-2021-006
https://notcve.org/view.php?id=CVE-2019-15297
05 Sep 2019 — res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference. res_pjsip_t38 en Sangoma Asterisk 15.x antes de 15.7.4 y 16.x antes de 16.5.1 permite a un atacante desencadenar un fallo enviando un flujo rechazado en una respuesta a una reinvitación T.38 iniciada por Asterisk. El fallo se produce debido a ... • http://downloads.asterisk.org/pub/security/AST-2019-004.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 19%CPEs: 8EXPL: 0CVE-2019-12827 – Asterisk Project Security Advisory - AST-2019-002
https://notcve.org/view.php?id=CVE-2019-12827
12 Jul 2019 — Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message. Desbordamiento de búfer en res_pjsip_messaging en Digium Asterisk versiones 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 versiones anteriores permite a los atacantes remotos autenticados cerrar inesperadamente Asterisk enviando un mensaje SIP MESSAGE especialmente diseñado. A specially crafted SIP i... • http://downloads.digium.com/pub/security/AST-2019-002.html • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 217EXPL: 0CVE-2019-13161 – Asterisk Project Security Advisory - AST-2019-003
https://notcve.org/view.php?id=CVE-2019-13161
12 Jul 2019 — An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.3... • http://downloads.digium.com/pub/security/AST-2019-003.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7550
https://notcve.org/view.php?id=CVE-2016-7550
23 May 2019 — asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service (remote). asterisk versión 13.10.0, se ve afectado por: problemas de Denegación de Servicio en asterisk. El impacto es: provocar una Denegación de Servicio (remota). • http://downloads.asterisk.org/pub/security/AST-2016-006.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 4%CPEs: 2EXPL: 0CVE-2019-7251 – Asterisk Project Security Advisory - AST-2019-001
https://notcve.org/view.php?id=CVE-2019-7251
28 Feb 2019 — An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation. Un error en la propiedad signedness de un número entero (para código devuelto) en el módulo res_pjsip_sdp_rtp en Digium Asterisk, en versiones 15.7.1 y anteriores y en las 16.1.1 y anteriores, permite a los atacantes remotos no autenticados cerrar inesperadament... • https://downloads.asterisk.org/pub/security/AST-2019-001.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 3%CPEs: 30EXPL: 1CVE-2018-19278
https://notcve.org/view.php?id=CVE-2018-19278
14 Nov 2018 — Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length. Desbordamiento de búfer en las búsquedas DNS SRV y NAPTR en Digium Asterisk en versiones 15.x anteriores a la 15.6.2 y versiones 16.x anteriores a la 16.0.1 permite que atacantes remotos provoquen el cierre in... • https://downloads.asterisk.org/pub/security/AST-2018-010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 80%CPEs: 33EXPL: 0CVE-2018-17281 – Asterisk Project Security Advisory - AST-2018-010
https://notcve.org/view.php?id=CVE-2018-17281
20 Sep 2018 — There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket. Hay una vulnerabilidad de consumo de pila en el módulo res_http_websocket.so de Asterisk hasta la versión 13.23.0; versiones 14.7.x anteriores a la 14.7.7 y las versiones 15.x anteriores a la 15... • http://downloads.asterisk.org/pub/security/AST-2018-009.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 1%CPEs: 8EXPL: 0CVE-2018-12227 – Gentoo Linux Security Advisory 201811-11
https://notcve.org/view.php?id=CVE-2018-12227
12 Jun 2018 — An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed ... • http://downloads.asterisk.org/pub/security/AST-2018-008.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 73%CPEs: 7EXPL: 3CVE-2018-7284 – Asterisk chan_pjsip 15.2.0 - 'SUBSCRIBE' Stack Corruption
https://notcve.org/view.php?id=CVE-2018-7284
22 Feb 2018 — A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash. Se ha descub... • https://packetstorm.news/files/id/146577 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 63%CPEs: 5EXPL: 2CVE-2018-7286 – Asterisk chan_pjsip 15.2.0 - 'INVITE' Denial of Service
https://notcve.org/view.php?id=CVE-2018-7286
22 Feb 2018 — An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection. Se ha descubierto un problema en Asterisk hasta la versión 13.19.1, versiones 14.x hasta la 14.7.5 y versiones 15.x hasta la 15.2.1; así como Certified Asterisk hasta la vers... • https://packetstorm.news/files/id/146580 •