CVSS: 5.3EPSS: 2%CPEs: 16EXPL: 1CVE-2020-28327
https://notcve.org/view.php?id=CVE-2020-28327
06 Nov 2020 — A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog i... • http://downloads.asterisk.org/pub/security/AST-2020-001.html • CWE-404: Improper Resource Shutdown or Release •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-28242
https://notcve.org/view.php?id=CVE-2020-28242
06 Nov 2020 — An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound aut... • http://downloads.asterisk.org/pub/security/AST-2020-002.html • CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2009-3723
https://notcve.org/view.php?id=CVE-2009-3723
29 Oct 2019 — asterisk allows calls on prohibited networks asterisk, permite llamadas sobre redes prohibidas • http://downloads.asterisk.org/pub/security/AST-2009-007.html • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12228
https://notcve.org/view.php?id=CVE-2018-12228
12 Jun 2018 — An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable. Se ha descubierto un problema en Asterisk Open Source en versiones 15.x anteriores a la 15.4.1. Cuando se conecta a Asterisk vía TCP/TLS, si el cliente se desconecta abruptamente o envía un mensaje especialmente ... • http://downloads.asterisk.org/pub/security/AST-2018-007.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 1%CPEs: 50EXPL: 0CVE-2017-9358
https://notcve.org/view.php?id=CVE-2017-9358
02 Jun 2017 — A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop). Existe una vulnerabilidad de agotamiento de memoria en Asterisk Open Source, en versiones 13.x anteriores a la 13.15.1 y versiones 14.x anteriores a la 14.4.1, y en Certified Asterisk, en versiones... • http://downloads.asterisk.org/pub/security/AST-2017-004.txt • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.3EPSS: 0%CPEs: 235EXPL: 0CVE-2013-2264 – Gentoo Linux Security Advisory 201401-15
https://notcve.org/view.php?id=CVE-2013-2264
29 Mar 2013 — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2)... • http://downloads.asterisk.org/pub/security/AST-2013-003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 8%CPEs: 16EXPL: 0CVE-2013-2685 – Gentoo Linux Security Advisory 201401-15
https://notcve.org/view.php?id=CVE-2013-2685
29 Mar 2013 — Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header. Desbordamiento de búfer basado en pila en res/res_format_attr_h264.c en Asterisk Open Source v11.x antes de v11.2.2 que permite a atacantes remotos ejecutar código arbitrario a través de un long sprop-parameter-sets el atributo media H.264 en un SIP Proto... • http://downloads.asterisk.org/pub/security/AST-2013-001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 2%CPEs: 232EXPL: 0CVE-2013-2686 – Gentoo Linux Security Advisory 201401-15
https://notcve.org/view.php?id=CVE-2013-2686
29 Mar 2013 — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-59... • http://downloads.asterisk.org/pub/security/AST-2013-002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 0%CPEs: 117EXPL: 0CVE-2012-2186
https://notcve.org/view.php?id=CVE-2012-2186
31 Aug 2012 — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action. Vulnerabilidad de lista negra incompleta en main/manager.c ... • http://downloads.asterisk.org/pub/security/AST-2012-012.html •
CVSS: 6.5EPSS: 3%CPEs: 72EXPL: 0CVE-2012-2948
https://notcve.org/view.php?id=CVE-2012-2948
02 Jun 2012 — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode. chan_skinny.c en el controlador de canal de Skinny (alias SCCP) en Certified Asterisk 1.8.11-cert antes de v1.8.11-cert2 y Asterisk Open Source v1.8.x antes de v1.8.12.1 y v10.x antes d... • http://archives.neohapsis.com/archives/bugtraq/2012-05/0145.html • CWE-399: Resource Management Errors •