CVE-2017-9372

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-02 · updated 2026-06-17
Weakness: CWE-119

Description

PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.

Affected products

Digium Certified Asterisk: 13.13.0, 13.13.0-cert1, 13.13.0-cert1-rc1, 13.13.0-cert1-rc2, 13.13.0-cert1-rc3, 13.13.0-cert1-rc4 (+4)
Digium Open Source: 13.0.0, 13.1.0, 13.1.0-rc1, 13.1.0-rc2, 13.2.0, 13.2.0-rc1 (+34)

References

http://downloads.asterisk.org/pub/security/AST-2017-002.txt
http://www.debian.org/security/2017/dsa-3933
http://www.securityfocus.com/bid/98572
http://www.securitytracker.com/id/1038529
https://bugs.debian.org/863901
http://downloads.asterisk.org/pub/security/AST-2017-002.txt
http://www.debian.org/security/2017/dsa-3933
http://www.securityfocus.com/bid/98572
http://www.securitytracker.com/id/1038529
https://bugs.debian.org/863901

Get alerted when CVE-2017-9372 or the next vulnerability affects your stack