What’s Vulnerable › Vulnerabilities
CVE-2018-7284
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 66.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2018-02-22 · updated 2026-06-17
- Weakness: CWE-119
Description
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
Affected products
- Debian Linux: 9.0
- Digium Asterisk: through 13.19.1; from 14.0.0 through 14.7.5; from 15.0.0 through 15.2.1
- Digium Certified Asterisk: through 13.18; 13.18-cert1, 13.18-cert2
References
- http://downloads.asterisk.org/pub/security/AST-2018-004.html
- http://www.securityfocus.com/bid/103151
- http://www.securitytracker.com/id/1040416
- https://www.debian.org/security/2018/dsa-4320
- https://www.exploit-db.com/exploits/44184/
- http://downloads.asterisk.org/pub/security/AST-2018-004.html
- http://www.securityfocus.com/bid/103151
- http://www.securitytracker.com/id/1040416
- https://www.debian.org/security/2018/dsa-4320
- https://www.exploit-db.com/exploits/44184/
Get alerted when CVE-2018-7284 or the next vulnerability affects your stack