CVE-2019-18976 — NULL Pointer Dereference in Asterisk

CWE-476 — NULL Pointer Dereference6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 62.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Digium AsteriskDebian AsteriskDebian Linux+1 more
Timeline
PublishedNov 22
Latest updateMay 24

Description

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/asterisk< asterisk 1:16.1.1~dfsg-1 (bullseye)
▶Debiandigium/asterisk< 1:16.1.1~dfsg-1
▶NVDdigium/asterisk13.0.0 — 13.29.1

Also affects: Debian Linux 9.0

🔴Vulnerability Details

2
GHSA
GHSA-6fr3-g4mr-859f: An issue was discovered in res_pjsip_t38↗2022-05-24
▶
OSV
CVE-2019-18976: An issue was discovered in res_pjsip_t38↗2019-11-22
▶

📋Vendor Advisories

1
Debian
CVE-2019-18976: asterisk - An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and ...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-18976 asterisk: null pointer dereference in res_pjsip_t38.c [epel-6]↗2020-02-11
▶
Bugzilla
CVE-2019-18976 asterisk: null pointer dereference in res_pjsip_t38.c↗2020-02-11
▶
CVE-2019-18976 — NULL Pointer Dereference in Asterisk | cvebase