MGASA-2014-0172

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0172.html
Import Source
https://advisories.mageia.org/MGASA-2014-0172.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2014-0172
Related
Published
2014-04-15T18:22:45Z
Modified
2014-04-15T18:22:18Z
Summary
Updated asterisk packages fix security vulnerabilities
Details

Updated asterisk packages fix security vulnerabilities:

In Asterisk before 11.8.1, sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request (CVE-2014-2286).

In Asterisk before 11.8.1, an attacker can use all available file descriptors using SIP INVITE requests. Each INVITE meeting certain conditions will leak a channel and several file descriptors. The file descriptors cannot be released without restarting Asterisk which may allow intrusion detection systems to be bypassed by sending the requests slowly (CVE-2014-2287).

References
Credits

Affected packages

Mageia:4 / asterisk

Package

Name
asterisk
Purl
pkg:rpm/mageia/asterisk?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
11.8.1-1.mga4

Ecosystem specific 

{
    "section": "core"
}