Homepage

Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package asterisk  (opens in a new tab)

Threat Intelligence

EPSS
67.82% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-ASTERISK-634731
  • published10 Sept 2020
  • disclosed9 Sept 2013
Report a new vulnerability Found a mistake?

Introduced: 9 Sep 2013

CVE-2013-5641  (opens in a new tab)
CWE-119  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream asterisk package and not the asterisk package as distributed by Ubuntu.

The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel. NOTE: some of these details are obtained from third party information.