Asterisk vulnerabilities

4 known vulnerabilities in Asterisk from Sangoma. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Asterisk: Incorrect Permission Assignment for Critical Resource

  CVE-2024-57520Feb 5, 2025SangomaEPSS 1.07%

  Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk pro

• 7.5 High severity

  Asterisk: Out-of-bounds Write

  CVE-2022-37325Dec 5, 2022SangomaEPSS 1.24%

  In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.

• 9.8 Critical severity

  pjproject: Use After Free

  CVE-2022-23608Feb 22, 2022PjsipEPSS 4.02%

  PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash k

• 9.1 Critical severity

  pjproject: Out-of-bounds Read

  CVE-2022-21723Jan 27, 2022PjsipEPSS 4.36%

  PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed mul