CVE-2012-2415

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-04-30 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.

Affected products

asterisk Open Source: 1.6.2.0, 1.6.2.0-rc2, 1.6.2.0-rc3, 1.6.2.0-rc4, 1.6.2.0-rc5, 1.6.2.0-rc6 (+147)

References

http://downloads.asterisk.org/pub/security/AST-2012-005.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
http://osvdb.org/81455
http://secunia.com/advisories/48891
http://secunia.com/advisories/48941
http://www.debian.org/security/2012/dsa-2460
http://www.securityfocus.com/bid/53210
http://www.securitytracker.com/id?1026962
https://exchange.xforce.ibmcloud.com/vulnerabilities/75102
http://downloads.asterisk.org/pub/security/AST-2012-005.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
http://osvdb.org/81455

Get alerted when CVE-2012-2415 or the next vulnerability affects your stack