VIR Vulnerability Intelligence Relay

CVE-2012-2415

medium
Published 2012-04-30 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
6.5

Description

Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
debian Debian Fixed 2 releases
VersionStatusFixed in
sid Fixed 1:1.8.11.1~dfsg-1
bullseye Fixed 1:1.8.11.1~dfsg-1

Application impact
VendorProductVersionsFixed
asteriskopen_source1.6.2.0
asteriskopen_source1.6.2.1
asteriskopen_source1.6.2.2
asteriskopen_source1.6.2.3
asteriskopen_source1.6.2.4
asteriskopen_source1.6.2.5
asteriskopen_source1.6.2.6
asteriskopen_source1.6.2.7
asteriskopen_source1.6.2.8
asteriskopen_source1.6.2.9
asteriskopen_source1.6.2.10
asteriskopen_source1.6.2.11
asteriskopen_source1.6.2.12
asteriskopen_source1.6.2.13
asteriskopen_source1.6.2.14
asteriskopen_source1.6.2.15
asteriskopen_source1.6.2.15.1
asteriskopen_source1.6.2.16
asteriskopen_source1.6.2.16.1
asteriskopen_source1.6.2.16.2
asteriskopen_source1.6.2.17
asteriskopen_source1.6.2.17.1
asteriskopen_source1.6.2.17.2
asteriskopen_source1.6.2.17.3
asteriskopen_source1.6.2.18
asteriskopen_source1.6.2.18.1
asteriskopen_source1.6.2.18.2
asteriskopen_source1.6.2.19
asteriskopen_source1.6.2.20
asteriskopen_source1.6.2.21
asteriskopen_source1.6.2.22
asteriskopen_source1.6.2.23
asteriskopen_source1.8.0
asteriskopen_source1.8.1
asteriskopen_source1.8.1.1
asteriskopen_source1.8.1.2
asteriskopen_source1.8.2
asteriskopen_source1.8.2.1
asteriskopen_source1.8.2.2
asteriskopen_source1.8.2.3
asteriskopen_source1.8.2.4
asteriskopen_source1.8.3
asteriskopen_source1.8.3.1
asteriskopen_source1.8.3.2
asteriskopen_source1.8.3.3
asteriskopen_source1.8.4
asteriskopen_source1.8.4.1
asteriskopen_source1.8.4.2
asteriskopen_source1.8.4.3
asteriskopen_source1.8.4.4
asteriskopen_source1.8.5
asteriskopen_source1.8.5.0
asteriskopen_source1.8.6.0
asteriskopen_source1.8.7.0
asteriskopen_source1.8.7.1
asteriskopen_source1.8.7.2
asteriskopen_source1.8.8.0
asteriskopen_source1.8.8.1
asteriskopen_source1.8.8.2
asteriskopen_source1.8.9.0
asteriskopen_source1.8.9.1
asteriskopen_source1.8.9.2
asteriskopen_source1.8.9.3
asteriskopen_source1.8.10.0
asteriskopen_source1.8.10.1
asteriskopen_source1.8.11.0
asteriskopen_source10.0.0
asteriskopen_source10.0.1
asteriskopen_source10.1.0
asteriskopen_source10.1.1
asteriskopen_source10.1.2
asteriskopen_source10.1.3
asteriskopen_source10.2.0
asteriskopen_source10.2.1
asteriskopen_source10.3.0

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.