CVSS: 8.8EPSS: 1%CPEs: 61EXPL: 0CVE-2017-7617
https://notcve.org/view.php?id=CVE-2017-7617
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action. La ejecución remota de código puede ocurrir en Asterisk Open Source 13.x en versiones anteriores a 13.14.1 y 14.x en versiones anteriores a 14.3.1 y Asterisk certificado 13.13 en versiones anteriores a 13.13-cert3 debido a un desbordamiento de búfer en un campo de usuario de CDR, relacionado con X-ClientCode en chan_sip , La función de dialplan CDR y la acción Monitor AMI. • http://downloads.asterisk.org/pub/security/AST-2017-001.html http://www.securityfocus.com/bid/97377 https://bugs.debian.org/859910 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 146EXPL: 0CVE-2016-9938
https://notcve.org/view.php?id=CVE-2016-9938
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. • http://downloads.asterisk.org/pub/security/AST-2016-009.html http://www.securityfocus.com/bid/94789 http://www.securitytracker.com/id/1037408 • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 4%CPEs: 113EXPL: 0CVE-2016-7551
https://notcve.org/view.php?id=CVE-2016-7551
chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion). chain_sip en Asterisk Open Source 11.x en versiones anteriores a 11.23.1 y 13.x 13.11.1 y Certified Asterisk 11.6 en versiones anteriores a 11.6-cert15 y 13.8 en versiones anteriores a 13.8-cert3 permite a atacantes remotos provocar una denegación de servicio (agotamiento portuario) • http://downloads.asterisk.org/pub/security/AST-2016-007.html http://www.debian.org/security/2016/dsa-3700 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838832 https://bugzilla.redhat.com/show_bug.cgi?id=1374733 https://issues.asterisk.org/jira/browse/ASTERISK-26272 • CWE-399: Resource Management Errors •