CVE-2014-9374 — Double Free in Asterisk

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
45.8%
top 2.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Digium AsteriskDebian AsteriskDigium Certified Asterisk
Timeline
PublishedDec 12
Latest updateMay 14

Description

Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDdigium/certified_asterisk11.6, 11.6.0+1
▶debiandebian/asterisk< asterisk 1:13.1.0~dfsg-1 (bullseye)
▶Debiandigium/asterisk< 1:13.1.0~dfsg-1
▶NVDdigium/asterisk26 versions+25

Patches

Patch: downloads.asterisk.org ↗Patch: downloads.asterisk.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4g26-4jfh-95vh: Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11↗2022-05-14
▶
OSV
CVE-2014-9374: Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11↗2014-12-12
▶

📋Vendor Advisories

1
Debian
CVE-2014-9374: asterisk - Double free vulnerability in the WebSocket Server (res_http_websocket module) in...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-9374 asterisk: Remote Crash Vulnerability in WebSocket Server (AST-2014-019)↗2014-12-11
▶
CVE-2014-9374 — Double Free in Debian Asterisk | cvebase