CVE-2016-9937

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2016-9937

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9937.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2016-9937

Published

2016-12-12T21:59:00.303Z

Modified

2026-07-08T05:49:39.305466019Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chansip or anonymous in chanpjsip an SDP offer or answer is still processed and the crash occurs.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:digium:asterisk:14.01:*:*:*:*:*:*:*",
                "cpe:2.3:a:digium:asterisk:14.02:*:*:*:*:*:*:*"
            ],
            "vendor_product": "digium:asterisk",
            "extracted_events": [
                {
                    "introduced": "14.01"
                },
                {
                    "last_affected": "14.01"
                },
                {
                    "introduced": "14.02"
                },
                {
                    "last_affected": "14.02"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type

GIT

Repo

https://github.com/asterisk/asterisk

Events

Introduced

226a7e36c538de73cee76de4183b1569bd5501e5

Last affected

37cde9225d9526e465698b958a6720d8e33709be

Database specific

{
    "cpe": [
        "cpe:2.3:a:digium:asterisk:13.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:13.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:14.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:14.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:14.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:14.1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:14.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "13.12"
        },
        {
            "last_affected": "13.12"
        },
        {
            "introduced": "13.13"
        },
        {
            "last_affected": "13.13"
        },
        {
            "introduced": "14.0"
        },
        {
            "last_affected": "14.0"
        },
        {
            "introduced": "14.1"
        },
        {
            "last_affected": "14.1"
        },
        {
            "introduced": "14.1.1"
        },
        {
            "last_affected": "14.1.1"
        },
        {
            "introduced": "14.1.2"
        },
        {
            "last_affected": "14.1.2"
        },
        {
            "introduced": "14.2"
        },
        {
            "last_affected": "14.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

13.*

13.12

13.13

14.*

14.0

14.1

14.1.1

14.1.2

14.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9937.json"