7.5

CVE-2017-9359

The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Open Source Version 13.0.0
Digium ≫ Open Source Version 13.1.0
Digium ≫ Open Source Version 13.1.0 Update rc1
Digium ≫ Open Source Version 13.1.0 Update rc2
Digium ≫ Open Source Version 13.2.0
Digium ≫ Open Source Version 13.2.0 Update rc1
Digium ≫ Open Source Version 13.3.0 Update rc1
Digium ≫ Open Source Version 13.4.0
Digium ≫ Open Source Version 13.4.0 Update rc1
Digium ≫ Open Source Version 13.5.0
Digium ≫ Open Source Version 13.5.0 Update rc1
Digium ≫ Open Source Version 13.6.0 Update rc1
Digium ≫ Open Source Version 13.7.0
Digium ≫ Open Source Version 13.7.0 Update rc1
Digium ≫ Open Source Version 13.8.0
Digium ≫ Open Source Version 13.8.0 Update rc1
Digium ≫ Open Source Version 13.8.1
Digium ≫ Open Source Version 13.8.2
Digium ≫ Open Source Version 13.9.0
Digium ≫ Open Source Version 13.9.0 Update rc1
Digium ≫ Open Source Version 13.10.0 Update rc1
Digium ≫ Open Source Version 13.11.0 Update rc1
Digium ≫ Open Source Version 13.12.0
Digium ≫ Open Source Version 13.12.0 Update rc1
Digium ≫ Open Source Version 13.12.1
Digium ≫ Open Source Version 13.12.2
Digium ≫ Open Source Version 13.13.0 Update rc1
Digium ≫ Open Source Version 13.14.0 Update rc1
Digium ≫ Open Source Version 13.15.0 Update rc1
Digium ≫ Open Source Version 14.2.0
Digium ≫ Open Source Version 14.2.0 Update rc1
Digium ≫ Open Source Version 14.2.0 Update rc2
Digium ≫ Certified Asterisk Version 13.13.0
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc3
Digium ≫ Certified Asterisk Version 13.13.0 Update cert1-rc4
Digium ≫ Certified Asterisk Version 13.13.0 Update cert2
Digium ≫ Certified Asterisk Version 13.13.0 Update cert3
Digium ≫ Certified Asterisk Version 13.13.0 Update rc1
Digium ≫ Certified Asterisk Version 13.13.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.8% 0.886
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

http://downloads.asterisk.org/pub/security/AST-2017-003.txt
Third Party Advisory
http://www.debian.org/security/2017/dsa-3933
http://www.securityfocus.com/bid/98578
Third Party Advisory
VDB Entry
https://bugs.debian.org/863902
Third Party Advisory
Mailing List
https://issues.asterisk.org/jira/browse/ASTERISK-26939
Third Party Advisory
Issue Tracking