Vulnerabilities > Digium

DATE CVE VULNERABILITY TITLE RISK
2021-03-05 CVE-2019-18351 Incorrect Permission Assignment for Critical Resource vulnerability in Digium Asterisk
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk through 13.29.1, through 16.6.1, and through 17.0.0; and Certified Asterisk through 13.21-cert4.
network
high complexity
digium CWE-732
4.0
2021-02-19 CVE-2021-26713 Out-Of-Bounds Write vulnerability in Digium Asterisk and Certified Asterisk
A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession.
network
low complexity
digium CWE-787
4.0
2021-02-18 CVE-2021-26712 Unspecified vulnerability in Digium Asterisk
Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.
network
low complexity
digium
5.0
2021-02-18 CVE-2021-26906 Improper Resource Shutdown OR Release vulnerability in Digium Asterisk
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5.
network
digium CWE-404
4.3
2021-02-18 CVE-2021-26717 Unspecified vulnerability in Digium Asterisk and Certified Asterisk
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6.
network
low complexity
digium
5.0
2021-02-18 CVE-2020-35776 Classic Buffer Overflow vulnerability in Digium Asterisk
A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.
network
digium CWE-120
4.3
2021-01-29 CVE-2020-35652 Unspecified vulnerability in Digium Asterisk
An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0.
network
low complexity
digium
4.0
2020-11-06 CVE-2020-28327 Improper Resource Shutdown OR Release vulnerability in multiple products
A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1.
network
high complexity
asterisk digium CWE-404
2.1
2019-11-22 CVE-2019-18610 Missing Authorization vulnerability in multiple products
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4.
network
low complexity
digium debian CWE-862
critical
9.0
2019-11-22 CVE-2019-18976 Null Pointer Dereference vulnerability in Digium Asterisk
An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x.
network
low complexity
digium CWE-476
5.0