| Package | Affected versions | Patched versions |
|---|---|---|
| asterisk | = 1.8.17.0= 1.8.18.0= 1.8.18.1= 1.8.19.0= 1.8.19.1= 1.8.20.0= 1.8.21.0= 1.8.22.0= 1.8.23.0= 10.10.0= 10.11.0= 10.12.0= 10.12.1= 10.12.2= 11.0.0= 11.0.1= 11.0.2= 11.1.0= 11.1.1= 11.1.2= 11.2.0= 11.3.0= 11.4.0= 11.5.0= 11.5.1 | |
| asterisk digiumphones | = 10.0.0= 10.11.0= 10.12.0= 10.12.1= 10.12.2 | |
| certified asterisk | = 1.8.15= 11.2.0 |
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free