Search for packages
| purl | pkg:deb/debian/asterisk@1:20.6.0~dfsg%2B~cs6.13.40431414-2 |
| Tags | Ghost |
| Next non-vulnerable version | 1:22.4.1~dfsg+~cs6.15.60671435-2 |
| Latest non-vulnerable version | 1:22.4.1~dfsg+~cs6.15.60671435-2 |
| Risk | 4.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-djaa-ugv5-aaas
Aliases: CVE-2023-38703 |
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch. | There are no reported fixed by versions. |
|
VCID-uvk4-hnk6-aaaq
Aliases: CVE-2023-37457 |
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2024-04-26T04:20:15.700666+00:00 | Debian Importer | Affected by | VCID-djaa-ugv5-aaas | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc4 |
| 2024-04-26T04:08:04.139011+00:00 | Debian Importer | Affected by | VCID-uvk4-hnk6-aaaq | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc4 |