CVE-2018-19278

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://downloads.asterisk.org/pub/security/AST-2018-010.htmlPatch, Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-28127Exploit, Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2018-010.htmlPatch, Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-28127Exploit, Vendor Advisory

Timeline

Published: Nov 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-192794.3PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second CVE-2018-19285.5IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access th CVE-2018-192806.1Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.CVE-2018-192819.8Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.CVE-2018-192829.8Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Ind CVE-2018-192866.1The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and CVE-2018-192876.1XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss CVE-2018-192886.1Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.CVE-2018-192896.1An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in CVE-2018-19294.3IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL CVE-2018-192909.8In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack ag CVE-2018-192916.5An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or