{"id":"CVE-2017-16671","details":"A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.","modified":"2026-07-08T05:49:51.808800183Z","published":"2017-11-09T00:29:00.473Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"digium:certified_asterisk","cpes":["cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc1:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc2:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc3:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert1_rc4:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert4:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert5:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:cert6:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.13.0-cert1"},{"last_affected":"13.13.0-cert1"},{"introduced":"13.13.0-cert1_rc1"},{"last_affected":"13.13.0-cert1_rc1"},{"introduced":"13.13.0-cert1_rc2"},{"last_affected":"13.13.0-cert1_rc2"},{"introduced":"13.13.0-cert1_rc3"},{"last_affected":"13.13.0-cert1_rc3"},{"introduced":"13.13.0-cert1_rc4"},{"last_affected":"13.13.0-cert1_rc4"},{"introduced":"13.13.0-cert2"},{"last_affected":"13.13.0-cert2"},{"introduced":"13.13.0-cert3"},{"last_affected":"13.13.0-cert3"},{"introduced":"13.13.0-cert4"},{"last_affected":"13.13.0-cert4"},{"introduced":"13.13.0-cert5"},{"last_affected":"13.13.0-cert5"},{"introduced":"13.13.0-cert6"},{"last_affected":"13.13.0-cert6"}]}]},"references":[{"type":"ADVISORY","url":"http://downloads.digium.com/pub/security/AST-2017-010.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/101760"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201811-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2017/dsa-4076"},{"type":"REPORT","url":"https://issues.asterisk.org/jira/browse/ASTERISK-27337"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"85335355efb2d7914a1fe20ed31afcef15fd210c"},{"fixed":"b7607c41e4825490ffea9d09c0b3b8f9d65f87c0"},{"introduced":"c6d6dd133c3db3b202f1f0d457780c9a6d841e0f"},{"fixed":"6a991af4be8be41d15e784c23e587773007f45ee"},{"introduced":"d4cc63728def7ca06ad3f70547de87bc5c9ef7c0"},{"fixed":"3f3172ac93420b172e5fc29c50f29143e05c88f6"},{"introduced":"fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0"},{"last_affected":"fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:digium:certified_asterisk:13.13.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.0.0"},{"fixed":"13.18.1"},{"introduced":"14.0.0"},{"fixed":"14.7.1"},{"introduced":"15.0.0"},{"fixed":"15.1.1"},{"introduced":"13.13.0"},{"last_affected":"13.13.0"}]}}],"versions":["13.13.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16671.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}