GCVE - cpe:2.3:a:digium:asterisk:12.2.0:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:digium:asterisk:12.2.0:rc1:*:*:*:*:*:*

part: a version: 12.2.0 update: rc1

Vendor	Digium (`05ad29b7-5b41-56d5-935d-a279ab7f14bc`)
Product	Asterisk (`a75a6886-b0b4-5160-9cfa-f749f3c86956`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/asterisk/asterisk`	purl2cpe	2026-06-01 10:15:41.778525

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2316`	vulnerable	2026-06-08 05:07:34.106601	Details available chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.520Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/82651 http://www.securitytracker.com/id/1034930 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2232`	vulnerable	2026-06-08 05:07:33.846485	Details available Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.950Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2016-003.html http://www.securitytracker.com/id/1034931 http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3008`	vulnerable	2026-06-08 05:06:36.532317	Details available Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Published: 2015-04-10T14:00:00.000Z Updated: 2024-08-06T05:32:21.258Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://www.securityfocus.com/bid/74022 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://advisories.mageia.org/MGASA-2015-0153.html http://www.securitytracker.com/id/1032052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1558`	vulnerable	2026-06-08 05:06:25.824502	Details available Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. Published: 2015-02-09T11:00:00.000Z Updated: 2024-08-06T04:47:17.146Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2015-001.html http://www.securitytracker.com/id/1031661 http://seclists.org/fulldisclosure/2015/Jan/116 http://www.securityfocus.com/archive/1/534573/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9374`	vulnerable	2026-06-08 05:06:11.554421	Details available Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. Published: 2014-12-12T15:00:00.000Z Updated: 2024-08-06T13:40:25.047Z Open on db.gcve.eu Reference links http://advisories.mageia.org/MGASA-2015-0010.html http://downloads.asterisk.org/pub/security/AST-2014-019.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:018 http://www.securityfocus.com/archive/1/534197/100/0/threaded http://packetstormsecurity.com/files/129473/Asterisk-Project-Security-Advisory-AST-2014-019.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6610`	vulnerable	2026-06-08 05:05:58.055789	Details available Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application. Published: 2014-11-26T15:00:00.000Z Updated: 2024-08-06T12:24:34.306Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2014-010.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6609`	vulnerable	2026-06-08 05:05:58.021943	Details available The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package. Published: 2014-11-26T15:00:00.000Z Updated: 2024-08-06T12:24:34.015Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2014-009.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4048`	vulnerable	2026-06-08 05:05:44.141568	Details available The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.479Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532416/100/0/threaded http://packetstormsecurity.com/files/127090/Asterisk-Project-Security-Advisory-AST-2014-008.html http://downloads.asterisk.org/pub/security/AST-2014-008.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4047`	vulnerable	2026-06-08 05:05:44.134270	Details available Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.373Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532415/100/0/threaded http://packetstormsecurity.com/files/127089/Asterisk-Project-Security-Advisory-AST-2014-007.html http://downloads.asterisk.org/pub/security/AST-2014-007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4046`	vulnerable	2026-06-08 05:05:44.045290	Details available Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:27.670Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532419/100/0/threaded http://packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html http://downloads.asterisk.org/pub/security/AST-2014-006.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4045`	vulnerable	2026-06-08 05:05:44.024006	Details available The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device. Published: 2014-06-17T14:00:00.000Z Updated: 2024-08-06T11:04:28.408Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532414/100/0/threaded http://packetstormsecurity.com/files/127087/Asterisk-Project-Security-Advisory-AST-2014-005.html http://downloads.asterisk.org/pub/security/AST-2014-005.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.