Skip to content
OpenAdvisories
High DLA-4326-1 2 CVEs

asterisk - security update

Published Oct 10, 2025 · Updated Oct 10, 2025

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 asterisk 1:16.28.0~dfsg-0+deb11u8

Vulnerabilities 2

  • High 7.0
    CVE-2025-1131

    Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

    A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk…

    asterisk asterisk asterisk asterisk Debian Ubuntu
  • Medium 6.5
    CVE-2025-54995

    Asterisk remotely exploitable leak of RTP UDP ports and internal resources

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This i…

    asterisk asterisk asterisk asterisk Debian Ubuntu