Debian Asterisk vulnerabilities

CVE-2021-43300 [CRITICAL] CVE-2021-43300: asterisk - Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-cont... Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Scope: local bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u1) sid: resolved (fixed in 1:18.11.1~dfsg+~cs6.10.40431413-1)

CVE-2017-14098 [HIGH] CVE-2017-14098: asterisk - In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x... In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash. Scope: local bullseye: resolved (fixed in 1:13.17.1~dfsg-1) sid: resolved (fixed in 1:13.17.1~dfsg-1)

CVE-2007-1561 [HIGH] CVE-2007-1561: asterisk - The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remot... The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address. Scope: local bullseye: resolved (fixed in 1:1.4.2~dfsg-5) sid: resolved (fixed in 1:1.4.2~dfsg-5)

CVE-2021-43299 [CRITICAL] CVE-2021-43299: asterisk - Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-contro... Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Scope: local bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u1) sid: resolved (fixed in 1:18.11.1~dfsg+~cs6.10.40431413-1)

CVE-2021-43301 [CRITICAL] CVE-2021-43301: asterisk - Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-cont... Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Scope: local bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u1) sid: resolved (fixed in 1:18.11.1~dfsg+~cs6.10.40431413-1)

CVE-2022-26499 [CRITICAL] CVE-2022-26499: asterisk - An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, i... An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2. Scope: local bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u1) sid: resolved (fixed in 1:18.11.2~dfsg+~cs6.10.40431

CVE-2022-21723 [CRITICAL] CVE-2022-21723: asterisk - PJSIP is a free and open source multimedia communication library written in C la... PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept S

CVE-2005-3559 [MEDIUM] CVE-2005-3559: asterisk - Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-b... Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter. Scope: local bullseye: resolved (fixed in 1:1.2.7.1.dfsg-2) sid: resolved (fixed in 1:1.2.7.1.dfsg-2)

CVE-2007-3764 [MEDIUM] CVE-2007-3764: asterisk - The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x befo... The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an "overly large memcpy."

CVE-2022-24754 [HIGH] CVE-2022-24754: asterisk - PJSIP is a free and open source multimedia communication library written in C la... PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP r

CVE-2017-7617 [HIGH] CVE-2017-7617: asterisk - Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and ... Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action. Scope: local bullseye: resolved (fixed in 1:13.14.1~dfsg-1) sid: resolved (fixed

CVE-2022-21722 [CRITICAL] CVE-2022-21722: asterisk - PJSIP is a free and open source multimedia communication library written in C la... PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that

CVE-2008-0095 [MEDIUM] CVE-2008-0095: asterisk - The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edi... The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which trigge

CVE-2022-23608 [HIGH] CVE-2022-23608: asterisk - PJSIP is a free and open source multimedia communication library written in C la... PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed

CVE-2007-3763 [MEDIUM] CVE-2007-3763: asterisk - The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1... The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which r

CVE-2021-43303 [CRITICAL] CVE-2021-43303: asterisk - Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlle... Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied Scope: local bullseye: resolved (fixed in 1:16.28.0~dfsg-0+deb11u1) sid: resolved (fixed in 1:18

CVE-2012-2186 [CRITICAL] CVE-2012-2186: asterisk - Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8... Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leverag

CVE-2011-1599 [CRITICAL] CVE-2011-1599: asterisk - manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1... manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an

CVE-2021-43845 [HIGH] CVE-2021-43845: asterisk - PJSIP is a free and open source multimedia communication library. In version 2.1... PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an inval

CVE-2014-2286 [HIGH] CVE-2014-2286: asterisk - main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1,... main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. Scope: local bull