Out-of-Bounds Affecting asterisk package, versions [1.4.0,1.4.44)[1.6.0,1.6.2.23)[1.8.0,1.8.10.1)[10.0.0,10.2.1)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
7.41% (95th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-ASTERISK-2371643
  • published26 Jan 2022
  • disclosed18 Sept 2012
  • creditUnknown

Introduced: 18 Sep 2012

CVE-2012-1183  (opens in a new tab)
CWE-119  (opens in a new tab)

How to fix?

Upgrade asterisk to version 1.4.44, 1.6.2.23, 1.8.10.1, 10.2.1 or higher.

Overview

Affected versions of this package are vulnerable to Out-of-Bounds. Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.

CVSS Base Scores

version 3.1