vulnwire
5.9med

CVE-2017-16672

An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 befo…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.7%
percentile 92%
Public exploits
0
none known

An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.

Exploit prediction (EPSS)

4.68% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

  • downloads.digium.com /pub/security/AST-2017-011.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/101765 · vdb-entry, x_refsource_BID, x_transferred
  • issues.asterisk.org /jira/browse/ASTERISK-27345 · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/201811-11 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • debian.org /security/2017/dsa-4076 · vendor-advisory, x_refsource_DEBIAN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.