Digium vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-26651 An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13.Critical 9.8 · Apr 15, 2022
• CVE-2022-26499 An SSRF issue was discovered in Asterisk through 19.x.Critical 9.1 · Apr 15, 2022
• CVE-2022-26498 An issue was discovered in Asterisk through 19.x.High 7.5 · Apr 15, 2022
• CVE-2021-32558 An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before High 7.5 · Jul 30, 2021
• CVE-2021-26712 Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticateHigh 7.5 · Feb 18, 2021
• CVE-2021-26717 An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6.High 7.5 · Feb 18, 2021
• CVE-2019-18610 An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4.High 8.8 · Nov 22, 2019
• CVE-2019-18976 An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x.High 7.5 · Nov 22, 2019
• CVE-2019-15639 main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific sceHigh 7.5 · Sep 9, 2019
• CVE-2016-7550 asterisk 13.10.0 is affected by: denial of service issues in asterisk.High 7.5 · May 23, 2019
• CVE-2018-19278 Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a speciaHigh 7.5 · Nov 14, 2018
• CVE-2018-17281 There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and CHigh 7.5 · Sep 24, 2018
• CVE-2018-7285 A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1.High 7.5 · Feb 21, 2018
• CVE-2018-7284 A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2.High 7.5 · Feb 21, 2018
• CVE-2017-17850 An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older.High 7.5 · Dec 27, 2017
• CVE-2017-17090 An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 aHigh 7.5 · Dec 1, 2017
• CVE-2017-16671 A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.High 8.8 · Nov 8, 2017
• CVE-2017-14603 In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insuffiHigh 7.5 · Oct 9, 2017
• CVE-2017-14001 An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior.High 8.8 · Sep 25, 2017
• CVE-2017-14100 In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthoCritical 9.8 · Sep 2, 2017
• CVE-2017-14099 In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x bHigh 7.5 · Sep 2, 2017
• CVE-2017-14098 In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header couHigh 7.5 · Sep 2, 2017
• CVE-2017-9372 PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remotHigh 7.5 · Jun 2, 2017
• CVE-2017-9359 The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, anHigh 7.5 · Jun 2, 2017
• CVE-2016-7551 chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote aHigh 7.5 · Apr 17, 2017