© 2026 vulntracker.io

CVE-2017-16671

N/A

Published: November 9, 2017 at 12:00 AM UTC

Updated: June 17, 2026 at 01:09 AM UTC

2 products affected across 1 vendorAsteriskCertified Asterisk

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 4%

Description

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asterisk · Digium

95%

13.0.0 ≤ v < 13.18.114.0.0 ≤ v < 14.7.115.0.0 ≤ v < 15.1.1

Affected range stops below 13.18.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.7.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.1.1, so it looks safe — our inference, not a vendor statement

Certified Asterisk · Digium

95%

13.13.0 13.13.0 cert113.13.0 cert1_rc113.13.0 cert1_rc213.13.0 cert1_rc313.13.0 cert1_rc413.13.0 cert2 13.13.0 cert3 13.13.0 cert4 13.13.0 cert5 13.13.0 cert6

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_CONFIRMVendor Advisory

Source: [email protected]

http://downloads.digium.com/pub/security/AST-2017-010.html

VDB Entryx_refsource_BIDThird Party Advisory

Source: [email protected]

http://www.securityfocus.com/bid/101760

x_refsource_CONFIRMIssue TrackingVendor Advisory

Source: [email protected]

https://issues.asterisk.org/jira/browse/ASTERISK-27337

Vendor Advisoryx_refsource_GENTOO

Source: [email protected]

https://security.gentoo.org/glsa/201811-11

Vendor Advisoryx_refsource_DEBIAN

Source: [email protected]

https://www.debian.org/security/2017/dsa-4076

CVSS

6.5MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-119

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card