CVE-2022-37325
HIGHSangoma Asterisk < 16.29.1 17.x-18.14.0 19.x-19.6.0 - Out-of-bounds Write in ooq931.c
Title source: llmDescription
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
References (7)
Core 7
Core References
Mitigation, Patch, Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-007.html
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5358
Mailing List
http://seclists.org/fulldisclosure/2026/Jul/2
Mailing List
http://seclists.org/fulldisclosure/2026/Jul/4
Mailing List
http://seclists.org/fulldisclosure/2026/Jul/6
Mailing List
http://seclists.org/fulldisclosure/2026/Jul/7
Scores
CVSS v3
7.5
EPSS
0.0110
EPSS Percentile
61.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-787
Status
published
Products (2)
sangoma/asterisk
20.0.0
sangoma/asterisk
16.0.0 - 16.29.1
Published
Dec 05, 2022
Tracked Since
Feb 18, 2026