GCVE - cpe:2.3:a:digium:asterisk:12.5.0:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:digium:asterisk:12.5.0:rc1:*:*:*:*:*:*

part: a version: 12.5.0 update: rc1

Vendor	Digium (`05ad29b7-5b41-56d5-935d-a279ab7f14bc`)
Product	Asterisk (`a75a6886-b0b4-5160-9cfa-f749f3c86956`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/asterisk/asterisk`	purl2cpe	2026-06-01 10:15:41.778602

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2316`	vulnerable	2026-06-08 05:07:34.106780	Details available chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.520Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/82651 http://www.securitytracker.com/id/1034930 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2232`	vulnerable	2026-06-08 05:07:33.852186	Details available Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost. Published: 2016-02-22T15:05:00.000Z Updated: 2024-08-05T23:24:48.950Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2016-003.html http://www.securitytracker.com/id/1034931 http://www.debian.org/security/2016/dsa-3700	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3008`	vulnerable	2026-06-08 05:06:36.537712	Details available Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Published: 2015-04-10T14:00:00.000Z Updated: 2024-08-06T05:32:21.258Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://www.securityfocus.com/bid/74022 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://advisories.mageia.org/MGASA-2015-0153.html http://www.securitytracker.com/id/1032052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1558`	vulnerable	2026-06-08 05:06:25.830171	Details available Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. Published: 2015-02-09T11:00:00.000Z Updated: 2024-08-06T04:47:17.146Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2015-001.html http://www.securitytracker.com/id/1031661 http://seclists.org/fulldisclosure/2015/Jan/116 http://www.securityfocus.com/archive/1/534573/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9374`	vulnerable	2026-06-08 05:06:11.558716	Details available Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. Published: 2014-12-12T15:00:00.000Z Updated: 2024-08-06T13:40:25.047Z Open on db.gcve.eu Reference links http://advisories.mageia.org/MGASA-2015-0010.html http://downloads.asterisk.org/pub/security/AST-2014-019.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:018 http://www.securityfocus.com/archive/1/534197/100/0/threaded http://packetstormsecurity.com/files/129473/Asterisk-Project-Security-Advisory-AST-2014-019.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6610`	vulnerable	2026-06-08 05:05:58.055986	Details available Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application. Published: 2014-11-26T15:00:00.000Z Updated: 2024-08-06T12:24:34.306Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2014-010.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6609`	vulnerable	2026-06-08 05:05:58.026544	Details available The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package. Published: 2014-11-26T15:00:00.000Z Updated: 2024-08-06T12:24:34.015Z Open on db.gcve.eu Reference links http://downloads.asterisk.org/pub/security/AST-2014-009.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.