Description
Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.8.13.1~dfsg-2 | — |
| Debian 6.0 | asterisk | 1:1.6.2.9-2+squeeze9 | DSA-2605-1 |
Advisories 1
- DSA-2605-1 asterisk - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://downloads.asterisk.org/pub/security/AST-2012-014
- DSA-2605 vendor-advisory