CVE-2019-15639 — Improper Input Validation in Asterisk

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGHNVD
EPSS
8.8%
top 7.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Digium AsteriskDebian Asterisk
Timeline
PublishedSep 9
Latest updateMay 24

Description

main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Alpinedigium/asterisk< 16.5.1-r0+12
▶NVDdigium/asterisk13.0.0 — 13.28.0+1

🔴Vulnerability Details

2
GHSA
GHSA-2vj6-p9c5-8h3v: main/translate↗2022-05-24
▶
OSV
CVE-2019-15639: main/translate↗2019-09-09
▶

📋Vendor Advisories

1
Debian
CVE-2019-15639: asterisk - main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker...↗2019
▶
CVE-2019-15639 — Improper Input Validation in Asterisk | cvebase