CVE-2017-9359 The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attacker...
HighCVSS 7.5
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digium open source | = 13.0.0 | No fix listed |
| digium open source | = 13.1.0 | No fix listed |
| digium open source | = 13.1.0-rc1 | No fix listed |
| digium open source | = 13.1.0-rc2 | No fix listed |
| digium open source | = 13.2.0 | No fix listed |
| digium open source | = 13.2.0-rc1 | No fix listed |
| digium open source | = 13.3.0-rc1 | No fix listed |
| digium open source | = 13.4.0 | No fix listed |
| digium open source | = 13.4.0-rc1 | No fix listed |
| digium open source | = 13.5.0 | No fix listed |
| digium open source | = 13.5.0-rc1 | No fix listed |
| digium open source | = 13.6.0-rc1 | No fix listed |
| digium open source | = 13.7.0 | No fix listed |
| digium open source | = 13.7.0-rc1 | No fix listed |
| digium open source | = 13.8.0 | No fix listed |
| digium open source | = 13.8.0-rc1 | No fix listed |
| digium open source | = 13.8.1 | No fix listed |
| digium open source | = 13.8.2 | No fix listed |
| digium open source | = 13.9.0 | No fix listed |
| digium open source | = 13.9.0-rc1 | No fix listed |
| digium open source | = 13.10.0-rc1 | No fix listed |
| digium open source | = 13.11.0-rc1 | No fix listed |
| digium open source | = 13.12.0 | No fix listed |
| digium open source | = 13.12.0-rc1 | No fix listed |
| digium open source | = 13.12.1 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| digium open source | = 13.12.2 | No fix listed |
| digium open source | = 13.13.0-rc1 | No fix listed |
| digium open source | = 13.14.0-rc1 | No fix listed |
| digium open source | = 13.15.0-rc1 | No fix listed |
| digium open source | = 14.2.0 | No fix listed |
| digium open source | = 14.2.0-rc1 | No fix listed |
| digium open source | = 14.2.0-rc2 | No fix listed |
| digium certified asterisk | = 13.13.0 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc1 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc2 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc3 | No fix listed |
| digium certified asterisk | = 13.13.0-cert1-rc4 | No fix listed |
| digium certified asterisk | = 13.13.0-cert2 | No fix listed |
| digium certified asterisk | = 13.13.0-cert3 | No fix listed |
| digium certified asterisk | = 13.13.0-rc1 | No fix listed |
| digium certified asterisk | = 13.13.0-rc2 | No fix listed |
References
- downloads.asterisk.org third-party-advisory
- DSA-3933 vendor-advisory
- 98578 third-party-advisory vdb-entry
- bugs.debian.org mailing-list third-party-advisory
- issues.asterisk.org issue-tracking third-party-advisory