Skip to content
OpenAdvisories
Medium WID-SEC-2026-0327 4 CVEs

Asterisk: Mehrere Schwachstellen

Published Feb 5, 2026 · Updated Nov 4, 2026 · Revision 5 · de-DE

Vendor: Debian Vendor: Fedora Product: Linux Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Asterisk ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code mit Root-Rechten auszuführen, erweiterte Privilegien zu erlangen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Asterisk ist eine komplette Open Source Multiprotokoll Telefonanlage (PBX) auf Softwarebasis.

Vulnerabilities 4

  • Low 3.5
    CVE-2026-23738

    The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML…

    asterisk asterisk asterisk asterisk Debian Ubuntu
  • Low 2.0
    CVE-2026-23739

    Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity…

    asterisk asterisk asterisk asterisk Debian Ubuntu
  • None 0.0
    CVE-2026-23740

    Asterisk vulnerable to potential privilege escalation

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an…

    asterisk asterisk asterisk asterisk Debian Ubuntu
  • None 0.0
    CVE-2026-23741

    ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper…

    asterisk asterisk asterisk asterisk Debian Ubuntu

Revision history

  1. #5

    Neue Updates von Fedora aufgenommen

  2. #4

    Neue Updates von Fedora aufgenommen

  3. #3

    Neue Updates von Debian aufgenommen

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-5617, EUVD-2026-5645, EUVD-2026-5646, EUVD-2026-5648

  5. #1

    Initiale Fassung

References