5.9
CVE-2017-16672
- EPSS 4.68%
- Veröffentlicht 09.11.2017 00:29:00
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Erkennungen
LoginAn issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Certified Asterisk Version 13.13.0
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1_rc4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert5
Digium ≫ Certified Asterisk Version 13.13.0 Update cert6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.68% | 0.906 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.9 | 2.2 | 3.6 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-772 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
https://security.gentoo.org/glsa/201811-11
https://www.debian.org/security/2017/dsa-4076
http://downloads.digium.com/pub/security/AST-2017-011.html
http://www.securityfocus.com/bid/101765
https://issues.asterisk.org/jira/browse/ASTERISK-27345