Skip to content
OpenAdvisories
Medium WID-SEC-2026-4205 5 CVEs

Asterisk: Mehrere Schwachstellen

Published Oct 27, 2026 · Updated Nov 4, 2026 · Revision 3 · de-DE

Vendor: Fedora Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Asterisk ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, beliebigen Programmcode auszuführen oder seine Privilegien zu erhöhen.

Product

Asterisk ist eine komplette Open Source Multiprotokoll Telefonanlage (PBX) auf Softwarebasis.

Vulnerabilities 5

  • High 8.2
    CVE-2026-57191

    Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Ac…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • High 7.5
    CVE-2026-57195

    Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an una…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 6.9
    CVE-2026-57203

    Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory.…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Medium 5.9
    CVE-2026-57194

    Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu
  • Low 2.3
    CVE-2026-57198

    Asterisk: Possible RED T.140 Heap Buffer Overflow

    Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing As…

    asterisk asterisk certified-asterisk asterisk Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Fedora aufgenommen

  2. #2

    Neue Updates von Fedora aufgenommen

  3. #1

    Initiale Fassung

References