{"id":"CVE-2018-19278","details":"Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.","modified":"2026-10-24T10:30:33.596714173Z","published":"2018-11-14T20:29:00.587Z","database_specific":{"unresolved_ranges":[{"vendor_product":"digium:asterisk","cpes":["cpe:2.3:a:digium:asterisk:15.0.0:b1:*:*:*:*:*:*","cpe:2.3:a:digium:asterisk:16.0.1:rc1:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"15.0.0-b1"},{"last_affected":"15.0.0-b1"},{"introduced":"16.0.1-rc1"},{"last_affected":"16.0.1-rc1"}]}]}]},"references":[{"type":"FIX","url":"https://downloads.asterisk.org/pub/security/AST-2018-010.html"},{"type":"EVIDENCE","url":"https://issues.asterisk.org/jira/browse/ASTERISK-28127"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"d4cc63728def7ca06ad3f70547de87bc5c9ef7c0"},{"last_affected":"e9e55148df22ad448e5321aad4e919b1ceec6862"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"15.0.0"},{"last_affected":"15.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.0.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.0.0:rc1:*:*:*:*:*:*","range":[{"introduced":"15.0.0-rc1"},{"last_affected":"15.0.0-rc1"}]},{"range":[{"introduced":"15.1.0"},{"last_affected":"15.1.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.1.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.1.0:rc1:*:*:*:*:*:*","range":[{"introduced":"15.1.0-rc1"},{"last_affected":"15.1.0-rc1"}]},{"cpe":"cpe:2.3:a:digium:asterisk:15.1.0:rc2:*:*:*:*:*:*","range":[{"introduced":"15.1.0-rc2"},{"last_affected":"15.1.0-rc2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:15.1.2:*:*:*:*:*:*:*","range":[{"introduced":"15.1.2"},{"last_affected":"15.1.2"}],"source":"CPE_STRING"},{"range":[{"introduced":"15.1.3"},{"last_affected":"15.1.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.1.3:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.1.4:*:*:*:*:*:*:*","range":[{"introduced":"15.1.4"},{"last_affected":"15.1.4"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.1.5:*:*:*:*:*:*:*","range":[{"introduced":"15.1.5"},{"last_affected":"15.1.5"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.2.0:rc1:*:*:*:*:*:*","range":[{"introduced":"15.2.0-rc1"},{"last_affected":"15.2.0-rc1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.2.0:rc2:*:*:*:*:*:*","range":[{"introduced":"15.2.0-rc2"},{"last_affected":"15.2.0-rc2"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.2.1:*:*:*:*:*:*:*","range":[{"introduced":"15.2.1"},{"last_affected":"15.2.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.2.2:*:*:*:*:*:*:*","range":[{"introduced":"15.2.2"},{"last_affected":"15.2.2"}]},{"range":[{"introduced":"15.3.0"},{"last_affected":"15.3.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.3.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"15.3.0-rc1"},{"last_affected":"15.3.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.3.0:rc1:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:15.3.0:rc2:*:*:*:*:*:*","range":[{"introduced":"15.3.0-rc2"},{"last_affected":"15.3.0-rc2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:15.4.0:*:*:*:*:*:*:*","range":[{"introduced":"15.4.0"},{"last_affected":"15.4.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.4.0:rc1:*:*:*:*:*:*","range":[{"introduced":"15.4.0-rc1"},{"last_affected":"15.4.0-rc1"}]},{"cpe":"cpe:2.3:a:digium:asterisk:15.4.0:rc2:*:*:*:*:*:*","range":[{"introduced":"15.4.0-rc2"},{"last_affected":"15.4.0-rc2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.4.1:*:*:*:*:*:*:*","range":[{"introduced":"15.4.1"},{"last_affected":"15.4.1"}]},{"cpe":"cpe:2.3:a:digium:asterisk:15.5.0:*:*:*:*:*:*:*","range":[{"introduced":"15.5.0"},{"last_affected":"15.5.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.5.0:rc1:*:*:*:*:*:*","range":[{"introduced":"15.5.0-rc1"},{"last_affected":"15.5.0-rc1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.6.0:*:*:*:*:*:*:*","range":[{"introduced":"15.6.0"},{"last_affected":"15.6.0"}]},{"range":[{"introduced":"15.6.0-rc1"},{"last_affected":"15.6.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.6.0:rc1:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:15.6.1:*:*:*:*:*:*:*","range":[{"introduced":"15.6.1"},{"last_affected":"15.6.1"}]},{"cpe":"cpe:2.3:a:digium:asterisk:16.0.0:*:*:*:*:*:*:*","range":[{"introduced":"16.0.0"},{"last_affected":"16.0.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"16.0.0-rc2"},{"last_affected":"16.0.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:16.0.0:rc2:*:*:*:*:*:*"},{"range":[{"introduced":"16.0.0-rc3"},{"last_affected":"16.0.0-rc3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:16.0.0:rc3:*:*:*:*:*:*"}]}}],"versions":["15.0.0","15.0.0-rc1","15.1.0","15.1.0-rc1","15.1.0-rc2","15.1.2","15.1.3","15.1.4","15.1.5","15.2.0-rc1","15.2.0-rc2","15.2.1","15.2.2","15.3.0","15.3.0-rc1","15.3.0-rc2","15.4.0","15.4.0-rc1","15.4.0-rc2","15.4.1","15.5.0","15.5.0-rc1","15.6.0","15.6.0-rc1","15.6.1","16.0.0","16.0.0-rc2","16.0.0-rc3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19278.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}