{"id":"UBUNTU-CVE-2018-7284","details":"A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.","modified":"2025-10-24T04:46:56Z","published":"2018-02-22T00:29:00Z","upstream":["CVE-2018-7284"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-7284"},{"type":"REPORT","url":"http://downloads.asterisk.org/pub/security/AST-2018-004.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2018-7284"}],"affected":[{"package":{"name":"asterisk","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/asterisk@1:13.1.0~dfsg-1.1ubuntu4.1+esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.1.0~dfsg-1.1ubuntu3","1:13.1.0~dfsg-1.1ubuntu4","1:13.1.0~dfsg-1.1ubuntu4.1","1:13.1.0~dfsg-1.1ubuntu4.1+esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-config"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-dev"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mobile"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-modules"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mp3"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mysql"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-7284.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/asterisk@1:13.18.3~dfsg-1ubuntu4?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.17.2~dfsg-1ubuntu1","1:13.17.2~dfsg-2ubuntu1","1:13.18.1~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu2","1:13.18.3~dfsg-1ubuntu3","1:13.18.3~dfsg-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-config"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-dev"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mobile"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-modules"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mp3"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mysql"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-tests"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-7284.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}