Unscored severity · published Oct 12, 2007
CVE-2007-5358
Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or (2) local users to execute arbitrary code via a long combination of astspooldir, voicemail context, and voicemail mailbox fields. NOTE: vector 2 requires write access to Asterisk configuration files.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asterisk · Digium
through 1.4.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5358
downloads.digium.com
http://downloads.digium.com/pub/security/AST-2007-022.html
osvdb.org
http://osvdb.org/38201
osvdb.org
http://osvdb.org/38202
secunia.com
http://secunia.com/advisories/27184
www.securityfocus.com
http://www.securityfocus.com/archive/1/481996/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/26005
More from Asterisk
9.8
CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13
9.8
CVE-2017-14100
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command…
9.1
CVE-2022-26499
An SSRF issue was discovered in Asterisk through 19.x
8.8
CVE-2019-18610
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4
8.8
CVE-2017-16671
A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7