Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-16672

An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.

Published

2017-11-09T00:29:00.520

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-772
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application digium asterisk < 13.18.1 Yes
Application digium asterisk < 14.7.1 Yes
Application digium asterisk < 15.1.1 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
Application digium certified_asterisk 13.13.0 Yes
References