CVE-2012-2948 Null dereference in n/a

What is CVE-2012-2948?

CVE-2012-2948 is a medium-severity vulnerability in n/a, published on 2 Jun 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode.

Weakness: CWE-399

Which versions are affected by CVE-2012-2948?

It affects 3 products.

Products include Asterisk Certified Asterisk, Asterisk Open Source, Sangoma Asterisk.

How do I fix CVE-2012-2948?

Upgrade to a fixed version.

Is CVE-2012-2948 being exploited?

There is no known exploitation of CVE-2012-2948 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-21723 Out-of-bounds read in multipart parsing in PJSIP Critical 9.1
• CVE-2022-23608 Use after free in PJSIP High 8.1
• CVE-2017-9358 Denial of service in n/a High 7.5
• CVE-2021-37706 Potential integer underflow upon receiving STUN message in PJSIP High 7.3
• CVE-2021-46837 Null dereference in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-2948, GHSA-chr5-w9ff-5gcw.