{"id":"CVE-2018-19278","details":"Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.","modified":"2026-07-08T05:51:10.528778852Z","published":"2018-11-14T20:29:00.587Z","database_specific":{"unresolved_ranges":[{"vendor_product":"digium:asterisk","cpes":["cpe:2.3:a:digium:asterisk:15.0.0:b1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:16.0.1:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0.0-b1"},{"last_affected":"15.0.0-b1"},{"introduced":"16.0.1-rc1"},{"last_affected":"16.0.1-rc1"}],"source":"CPE_STRING"}]},"references":[{"type":"FIX","url":"https://downloads.asterisk.org/pub/security/AST-2018-010.html"},{"type":"EVIDENCE","url":"https://issues.asterisk.org/jira/browse/ASTERISK-28127"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"d4cc63728def7ca06ad3f70547de87bc5c9ef7c0"},{"last_affected":"e9e55148df22ad448e5321aad4e919b1ceec6862"}],"database_specific":{"cpe":["cpe:2.3:a:digium:asterisk:15.0.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.0:rc2:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.2:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.3:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.4:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.1.5:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.2.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.2.0:rc2:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.2.1:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.2.2:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.3.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.3.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.3.0:rc2:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.4.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.4.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.4.0:rc2:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.4.1:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.5.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.5.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.6.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.6.0:rc1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:15.6.1:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:16.0.0:*:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:16.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:16.0.0:rc3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0.0"},{"last_affected":"15.0.0"},{"introduced":"15.0.0-rc1"},{"last_affected":"15.0.0-rc1"},{"introduced":"15.1.0"},{"last_affected":"15.1.0"},{"introduced":"15.1.0-rc1"},{"last_affected":"15.1.0-rc1"},{"introduced":"15.1.0-rc2"},{"last_affected":"15.1.0-rc2"},{"introduced":"15.1.2"},{"last_affected":"15.1.2"},{"introduced":"15.1.3"},{"last_affected":"15.1.3"},{"introduced":"15.1.4"},{"last_affected":"15.1.4"},{"introduced":"15.1.5"},{"last_affected":"15.1.5"},{"introduced":"15.2.0-rc1"},{"last_affected":"15.2.0-rc1"},{"introduced":"15.2.0-rc2"},{"last_affected":"15.2.0-rc2"},{"introduced":"15.2.1"},{"last_affected":"15.2.1"},{"introduced":"15.2.2"},{"last_affected":"15.2.2"},{"introduced":"15.3.0"},{"last_affected":"15.3.0"},{"introduced":"15.3.0-rc1"},{"last_affected":"15.3.0-rc1"},{"introduced":"15.3.0-rc2"},{"last_affected":"15.3.0-rc2"},{"introduced":"15.4.0"},{"last_affected":"15.4.0"},{"introduced":"15.4.0-rc1"},{"last_affected":"15.4.0-rc1"},{"introduced":"15.4.0-rc2"},{"last_affected":"15.4.0-rc2"},{"introduced":"15.4.1"},{"last_affected":"15.4.1"},{"introduced":"15.5.0"},{"last_affected":"15.5.0"},{"introduced":"15.5.0-rc1"},{"last_affected":"15.5.0-rc1"},{"introduced":"15.6.0"},{"last_affected":"15.6.0"},{"introduced":"15.6.0-rc1"},{"last_affected":"15.6.0-rc1"},{"introduced":"15.6.1"},{"last_affected":"15.6.1"},{"introduced":"16.0.0"},{"last_affected":"16.0.0"},{"introduced":"16.0.0-rc2"},{"last_affected":"16.0.0-rc2"},{"introduced":"16.0.0-rc3"},{"last_affected":"16.0.0-rc3"}],"source":"CPE_STRING"}}],"versions":["15.0.0","15.0.0-rc1","15.1.0","15.1.0-rc1","15.1.0-rc2","15.1.2","15.1.3","15.1.4","15.1.5","15.2.0-rc1","15.2.0-rc2","15.2.1","15.2.2","15.3.0","15.3.0-rc1","15.3.0-rc2","15.4.0","15.4.0-rc1","15.4.0-rc2","15.4.1","15.5.0","15.5.0-rc1","15.6.0","15.6.0-rc1","15.6.1","16.0.0","16.0.0-rc2","16.0.0-rc3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19278.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}