CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-15297
https://notcve.org/view.php?id=CVE-2019-15297
res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference. res_pjsip_t38 en Sangoma Asterisk 15.x antes de 15.7.4 y 16.x antes de 16.5.1 permite a un atacante desencadenar un fallo enviando un flujo rechazado en una respuesta a una reinvitación T.38 iniciada por Asterisk. El fallo se produce debido a una derivación de objeto de medios de sesión NULL. • http://downloads.asterisk.org/pub/security/AST-2019-004.html http://packetstormsecurity.com/files/154371/Asterisk-Project-Security-Advisory-AST-2019-004.html http://packetstormsecurity.com/files/161671/Asterisk-Project-Security-Advisory-AST-2021-006.html http://seclists.org/fulldisclosure/2021/Mar/5 • CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 0%CPEs: 217EXPL: 0CVE-2019-13161
https://notcve.org/view.php?id=CVE-2019-13161
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration). Se detectó un problema en Asterisk Open Source hasta versiones 13.27.0, 14.x y 15.x hasta 15.7.2, y versiones 16.x hasta 16.4.0, y Certified Asterisk hasta versión 13.21-cert3. • http://downloads.digium.com/pub/security/AST-2019-003.html https://issues.asterisk.org/jira/browse/ASTERISK-28465 https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 4%CPEs: 8EXPL: 0CVE-2019-12827
https://notcve.org/view.php?id=CVE-2019-12827
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message. Desbordamiento de búfer en res_pjsip_messaging en Digium Asterisk versiones 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 versiones anteriores permite a los atacantes remotos autenticados cerrar inesperadamente Asterisk enviando un mensaje SIP MESSAGE especialmente diseñado. • http://downloads.digium.com/pub/security/AST-2019-002.html https://issues.asterisk.org/jira/browse/ASTERISK-28447 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7251
https://notcve.org/view.php?id=CVE-2019-7251
An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation. Un error en la propiedad signedness de un número entero (para código devuelto) en el módulo res_pjsip_sdp_rtp en Digium Asterisk, en versiones 15.7.1 y anteriores y en las 16.1.1 y anteriores, permite a los atacantes remotos no autenticados cerrar inesperadamente Asterisk mediante una violación de protocolo SDP especialmente manipulada. • https://downloads.asterisk.org/pub/security/AST-2019-001.html https://issues.asterisk.org/jira/browse/ASTERISK-28260 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 1CVE-2018-19278
https://notcve.org/view.php?id=CVE-2018-19278
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length. Desbordamiento de búfer en las búsquedas DNS SRV y NAPTR en Digium Asterisk en versiones 15.x anteriores a la 15.6.2 y versiones 16.x anteriores a la 16.0.1 permite que atacantes remotos provoquen el cierre inesperado de Asterisk mediante una respuesta DNS SRV o NAPTR especialmente manipulada. Esto se debe a que se supone que un tamaño de búfer coincide con una longitud expandida, pero en realidad coincide con una longitud comprimida. • https://downloads.asterisk.org/pub/security/AST-2018-010.html https://issues.asterisk.org/jira/browse/ASTERISK-28127 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •