Vulnerabilities > Digium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2006-08-24 | CVE-2006-4346 | Remote vulnerability in Digium Asterisk 1.2.10 Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable. | 7.5 |
| 2006-08-24 | CVE-2006-4345 | Remote vulnerability in Asterisk Stack-based buffer overflow in channels/chan_mgcp.c in MGCP in Asterisk 1.0 through 1.2.10 allows remote attackers to execute arbitrary code via a crafted audit endpoint (AUEP) response. | 7.5 |
| 2006-06-07 | CVE-2006-2898 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Digium Asterisk The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. | 7.5 |
| 2006-04-18 | CVE-2006-1827 | Integer Overflow vulnerability in Asterisk JPEG File Handling Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length. | 6.4 |
| 2005-11-16 | CVE-2005-3559 | Unspecified vulnerability in Digium Asterisk Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. | 5.0 |
| 2005-07-05 | CVE-2005-2081 | Unspecified vulnerability in Digium Asterisk 1.0.7 Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character. | 5.0 |
| 2003-09-22 | CVE-2003-0779 | Unspecified vulnerability in Digium Asterisk SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID string. | 7.5 |
| 2003-09-17 | CVE-2003-0761 | Remote Security vulnerability in Digium Asterisk 1.2.13 Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests. | 7.5 |