GCVE - cpe:2.3:a:digium:asterisk:1.8.15.0:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:digium:asterisk:1.8.15.0:-:*:*:*:*:*:*

part: a version: 1.8.15.0 update: -

Vendor	Digium (`05ad29b7-5b41-56d5-935d-a279ab7f14bc`)
Product	Asterisk (`a75a6886-b0b4-5160-9cfa-f749f3c86956`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/asterisk/asterisk`	purl2cpe	2026-06-01 10:15:41.875320

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2316`	vulnerable	2026-06-08 05:07:34.104517	Details available chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.520Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/82651 http://www.securitytracker.com/id/1034930 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2232`	vulnerable	2026-06-08 05:07:33.780045	Details available Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.950Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2016-003.html http://www.securitytracker.com/id/1034931 http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3008`	vulnerable	2026-06-08 05:06:36.469912	Details available Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Published: 2015-04-10T14:00:00.000Z Updated: 2024-08-06T05:32:21.258Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://www.securityfocus.com/bid/74022 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://advisories.mageia.org/MGASA-2015-0153.html http://www.securitytracker.com/id/1032052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4047`	vulnerable	2026-06-08 05:05:44.106959	Details available Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.373Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532415/100/0/threaded http://packetstormsecurity.com/files/127089/Asterisk-Project-Security-Advisory-AST-2014-007.html http://downloads.asterisk.org/pub/security/AST-2014-007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2287`	vulnerable	2026-06-08 05:05:28.357161	Details available channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. Published: 2014-04-18T19:00:00.000Z Updated: 2024-08-06T10:06:00.091Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/66094 http://downloads.asterisk.org/pub/security/AST-2014-002.html https://issues.asterisk.org/jira/browse/ASTERISK-23373 http://www.mandriva.com/security/advisories?name=MDVSA-2014:078 http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2286`	vulnerable	2026-06-08 05:05:28.286098	Details available main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. Published: 2014-04-18T19:00:00.000Z Updated: 2024-08-06T10:06:00.334Z Open on db.gcve.eu Reference links https://issues.asterisk.org/jira/browse/ASTERISK-23340 http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff http://downloads.asterisk.org/pub/security/AST-2014-001.html http://www.securityfocus.com/bid/66093 http://www.mandriva.com/security/advisories?name=MDVSA-2014:078	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.