CVE Feed

    Dashboard / CVE / CVE-2013-2685

    CVE-2013-2685

    Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.

    Published:Mar 29, 2013
    Last Modified:Apr 11, 2025
    EPS:Mar 29, 2013
    EPSS Score:0.08932
    CVSS Score:7.5

    Affected Products

    Vendor
    Asterisk
    Product
    Open Source

    Exploits

    No exploit reference

    Related CVEs

    CVE-2013-2264 (CVSS 5) — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.…
    CVE-2013-2686 (CVSS 5) — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x be…
    CVE-2012-2186 (CVSS 9) — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x be…
    CVE-2012-2948 (CVSS 4) — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 an…
    CVE-2012-2416 (CVSS 6.5) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and …
    CVE-2012-2415 (CVSS 6.5) — Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x befor…
    CVE-2012-2414 (CVSS 6.5) — main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1…
    CVE-2012-0885 (CVSS 4.3) — chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is us…
    CVE-2011-4063 (CVSS 6.8) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 d…
    CVE-2009-2346 (CVSS 7.8) — The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x b…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High