FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
ffa364e1-ebf5-11eb-aef1-0897988a1c07asterisk -- Remote Crash Vulnerability in PJSIP channel driver

The Asterisk project reports:

When Asterisk receives a re-INVITE without SDP after having sent a BYE request a crash will occur. This occurs due to the Asterisk channel no longer being present while code assumes it is.


Discovery 2021-04-06
Entry 2021-07-23
asterisk16
ge 16.17.0 lt 16.19.1

asterisk18
ge 18.3.0 lt 18.5.1

CVE-2021-31878
https://downloads.asterisk.org/pub/security/AST-2021-007.html
a5de43ed-bc49-11ec-b516-0897988a1c07Asterisk -- func_odbc: Possible SQL Injection

The Asterisk project reports:

Some databases can use backslashes to escape certain characters, such as backticks. If input is provided to func_odbc which includes backslashes it is possible for func_odbc to construct a broken SQL query and the SQL query to fail.


Discovery 2022-04-14
Entry 2022-04-14
asterisk16
< 16.25.2

asterisk18
< 18.11.2

CVE-2022-26651
https://downloads.asterisk.org/pub/security/AST-2022-003.html
53fbffe6-ebf7-11eb-aef1-0897988a1c07asterisk -- pjproject/pjsip: crash when SSL socket destroyed during handshake

The Asterisk project reports:

Depending on the timing, it's possible for Asterisk to crash when using a TLS connection if the underlying socket parent/listener gets destroyed during the handshake.


Discovery 2021-05-05
Entry 2021-07-23
asterisk13
< 13.38.3

asterisk16
< 16.19.1

asterisk18
< 18.5.1

CVE-2021-32686
https://downloads.asterisk.org/pub/security/AST-2021-009.html
fb3455be-ebf6-11eb-aef1-0897988a1c07asterisk -- Remote crash when using IAX2 channel driver

The Asterisk project reports:

If the IAX2 channel driver receives a packet that contains an unsupported media format it can cause a crash to occur in Asterisk.


Discovery 2021-04-13
Entry 2021-07-23
asterisk13
< 13.38.3

asterisk16
< 16.19.1

asterisk18
< 18.5.1

CVE-2021-32558
https://downloads.asterisk.org/pub/security/AST-2021-008.html
8838abf0-bc47-11ec-b516-0897988a1c07Asterisk -- multiple vulnerabilities

The Asterisk project reports:

AST-2022-001 - When using STIR/SHAKEN, its possible to download files that are not certificates. These files could be much larger than what you would expect to download.

AST-2022-002 - When using STIR/SHAKEN, its possible to send arbitrary requests like GET to interfaces such as localhost using the Identity header.


Discovery 2022-04-14
Entry 2022-04-14
asterisk16
gt 16.15.0 lt 16.25.2

asterisk18
< 18.11.2

CVE-2022-26498
https://downloads.asterisk.org/pub/security/AST-2022-001.html
CVE-2022-26499
https://downloads.asterisk.org/pub/security/AST-2022-002.html
964c5460-9c66-11ec-ad3a-001999f8d30basterisk -- multiple vulnerabilities

The Asterisk project reports:

AST-2022-004 - The header length on incoming STUN messages that contain an ERROR-CODE attribute is not properly checked. This can result in an integer underflow. Note, this requires ICE or WebRTC support to be in use with a malicious remote party.

AST-2022-005 - When acting as a UAC, and when placing an outgoing call to a target that then forks Asterisk may experience undefined behavior (crashes, hangs, etc) after a dialog set is prematurely freed.

AST-2022-006 - If an incoming SIP message contains a malformed multi-part body an out of bounds read access may occur, which can result in undefined behavior. Note, its currently uncertain if there is any externally exploitable vector within Asterisk for this issue, but providing this as a security issue out of caution.


Discovery 2022-03-03
Entry 2022-03-05
asterisk16
< 16.24.1

asterisk18
< 18.10.1

CVE-2021-37706
CVE-2022-23608
CVE-2022-21723
https://downloads.asterisk.org/pub/security/AST-2022-004.html
https://downloads.asterisk.org/pub/security/AST-2022-005.html
https://downloads.asterisk.org/pub/security/AST-2022-006.html