CVSS: 6.5EPSS: 0%CPEs: 288EXPL: 0CVE-2016-2232
https://notcve.org/view.php?id=CVE-2016-2232
Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost. Asterisk Open Source 1.8.x, 11.x en versiones anteriores a 11.21.1, 12.x y 13.x en versiones anteriores a 13.7.1 y Certified Asterisk 1.8.28, 11.6 en versiones anteriores a 11.6-cert12 y 13.1 en versiones anteriores a 13.1-cert3 permiten a usuarios remotos autenticados causar una denegación de servicio (referencia a puntero no inicializado y caída) a través de un error de longitud cero corrigiendo la redundancia de paquetes para un paquete UDPTL FAX que se ha perdido. • http://downloads.asterisk.org/pub/security/AST-2016-003.html http://www.debian.org/security/2016/dsa-3700 http://www.securitytracker.com/id/1034931 •
CVSS: 7.1EPSS: 2%CPEs: 290EXPL: 1CVE-2016-2316
https://notcve.org/view.php?id=CVE-2016-2316
chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. chan_sip en Asterisk Open Source 1.8.x, 11.x en versiones anteriores a 11.21.1, 12.x y 13.x en versiones anteriores a 13.7.1 y Certified Asterisk 1.8.28, 11.6 en versiones anteriores a 11.6-cert12 y 13.1 en versiones anteriores a 13.1-cert3, cuando la configuración de timert1 en sip.conf se establece en un valor mayor que 1245, permite a atacantes remotos causar una denegación de servicio (consumo de descriptor de archivo) a través de vectores relacionados con valores de caducidad de retransmisión grandes. • http://downloads.asterisk.org/pub/security/AST-2016-002.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html http://www.debian.org/security/2016/dsa-3700 http://www.securityfocus.com/bid/82651 http://www.securitytracker.com/id/1034930 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 4.3EPSS: 80%CPEs: 322EXPL: 0CVE-2015-3008
https://notcve.org/view.php?id=CVE-2015-3008
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Asterisk Open Source 1.8 anterior a 1.8.32.3, 11.x anterior a 11.17.1, 12.x anterior a 12.8.2, y 13.x anterior a 13.3.2 y Certified Asterisk 1.8.28 anterior a 1.8.28-cert5, 11.6 anterior a 11.6-cert11, y 13.1 anterior a 13.1-cert2, cuando registra un dispositivo SIP TLS, no maneja correctamente un byte nulo en un nombre de dominio en el campo Common Name (CN) del sujeto de un certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL arbitrarios a través de un certificado manipulado emitido por una autoridad de certificación legítima. • http://advisories.mageia.org/MGASA-2015-0153.html http://downloads.asterisk.org/pub/security/AST-2015-003.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162260.html http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://seclists.org/fulldisclosure/2015/Apr/22 http://www.debian.org/security/2016/dsa-3700 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://www.securityfocus.com/archive/1/535222/100/0 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 217EXPL: 0CVE-2014-4047
https://notcve.org/view.php?id=CVE-2014-4047
Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. Asterisk Open Source 1.8.x anterior a 1.8.28.1, 11.x anterior a 11.10.1 y 12.x anterior a 12.3.1 y Certified Asterisk 1.8.15 anterior a 1.8.15-cert6 y 11.6 anterior a 11.6-cert3 permiten a atacantes remotos causar una denegación de servicio (consumo de conexión) a través de un número grande de conexiones HTTP (1) inactivas o (2) incompletas. • http://downloads.asterisk.org/pub/security/AST-2014-007.html http://packetstormsecurity.com/files/127089/Asterisk-Project-Security-Advisory-AST-2014-007.html http://www.securityfocus.com/archive/1/532415/100/0/threaded •
CVSS: 3.5EPSS: 63%CPEs: 232EXPL: 0CVE-2014-2287
https://notcve.org/view.php?id=CVE-2014-2287
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. channels/chan_sip.c en Asterisk Open Source 1.8.x anterior a 1.8.26.1, 11.8.x anterior a 11.8.1 y 12.1.x anterior a 12.1.1, y Certified Asterisk 1.8.15 anterior a 1.8.15-cert5 y 11.6 anterior a 11.6-cert2, cuando chan_sip tiene cierta configuración, permite a usuarios remotos autenticados causar una denegación de servicio (consumo de canal y consumo de descriptores de archivo) a través de una solicitud INVITE con una cabecera (1) Session-Expires o (2) Min-SE con un valor malformado o invalido. • http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff http://downloads.asterisk.org/pub/security/AST-2014-002.html http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:078 http://www.securityfocus.com/bid/66094 https://issues.asterisk.org/jira/browse/ASTERISK-23373 • CWE-20: Improper Input Validation •