GCVE - cpe:2.3:a:digium:asterisk:12.1.0:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:digium:asterisk:12.1.0:-:*:*:*:*:*:*

part: a version: 12.1.0 update: -

Vendor	Digium (`05ad29b7-5b41-56d5-935d-a279ab7f14bc`)
Product	Asterisk (`a75a6886-b0b4-5160-9cfa-f749f3c86956`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/asterisk/asterisk`	purl2cpe	2026-06-01 10:15:41.778485

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2316`	vulnerable	2026-06-08 05:07:34.106506	Details available chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.520Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/82651 http://www.securitytracker.com/id/1034930 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2232`	vulnerable	2026-06-08 05:07:33.843416	Details available Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.950Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2016-003.html http://www.securitytracker.com/id/1034931 http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3008`	vulnerable	2026-06-08 05:06:36.529401	Details available Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Published: 2015-04-10T14:00:00.000Z Updated: 2024-08-06T05:32:21.258Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://www.securityfocus.com/bid/74022 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://advisories.mageia.org/MGASA-2015-0153.html http://www.securitytracker.com/id/1032052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1558`	vulnerable	2026-06-08 05:06:25.821217	Details available Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. Published: 2015-02-09T11:00:00.000Z Updated: 2024-08-06T04:47:17.146Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2015-001.html http://www.securitytracker.com/id/1031661 http://seclists.org/fulldisclosure/2015/Jan/116 http://www.securityfocus.com/archive/1/534573/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4048`	vulnerable	2026-06-08 05:05:44.141457	Details available The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.479Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532416/100/0/threaded http://packetstormsecurity.com/files/127090/Asterisk-Project-Security-Advisory-AST-2014-008.html http://downloads.asterisk.org/pub/security/AST-2014-008.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4047`	vulnerable	2026-06-08 05:05:44.134145	Details available Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.373Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532415/100/0/threaded http://packetstormsecurity.com/files/127089/Asterisk-Project-Security-Advisory-AST-2014-007.html http://downloads.asterisk.org/pub/security/AST-2014-007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4046`	vulnerable	2026-06-08 05:05:44.045179	Details available Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:27.670Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532419/100/0/threaded http://packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html http://downloads.asterisk.org/pub/security/AST-2014-006.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4045`	vulnerable	2026-06-08 05:05:44.020812	Details available The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.408Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532414/100/0/threaded http://packetstormsecurity.com/files/127087/Asterisk-Project-Security-Advisory-AST-2014-005.html http://downloads.asterisk.org/pub/security/AST-2014-005.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2288`	vulnerable	2026-06-08 05:05:28.378653	Details available The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request. Published: 2014-04-18T19:00:00.000Z Updated: 2024-08-06T10:06:00.194Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff http://downloads.asterisk.org/pub/security/AST-2014-003.html https://issues.asterisk.org/jira/browse/ASTERISK-23210 http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2287`	vulnerable	2026-06-08 05:05:28.358063	Details available channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. Published: 2014-04-18T19:00:00.000Z Updated: 2024-08-06T10:06:00.091Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/66094 http://downloads.asterisk.org/pub/security/AST-2014-002.html https://issues.asterisk.org/jira/browse/ASTERISK-23373 http://www.mandriva.com/security/advisories?name=MDVSA-2014:078 http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2286`	vulnerable	2026-06-08 05:05:28.312523	Details available main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. Published: 2014-04-18T19:00:00.000Z Updated: 2024-08-06T10:06:00.334Z Open on db.gcve.eu Reference links https://issues.asterisk.org/jira/browse/ASTERISK-23340 http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff http://downloads.asterisk.org/pub/security/AST-2014-001.html http://www.securityfocus.com/bid/66093 http://www.mandriva.com/security/advisories?name=MDVSA-2014:078	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.