CVE-2017-9372
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified...
CVE-2017-9372 is a high vulnerability (CVSS 7.5) in Digium Certified Asterisk, published June 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.99%, the 90th percentile. Fixed in pjproject 2.1.0.0.ast20130823-1+deb8u1.
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
CVE-2017-9372- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
CVE-2017-9372- Updated
- 2026-11-02
EUVDEUVD-2017-18307 No score
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
EUVD-2017-18307- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9w9-cxp5-6pq8
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified...
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
GHSA-f9w9-cxp5-6pq8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
CVE-2017-9372- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9372
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
- Record
UBUNTU-CVE-2017-9372- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0368 No score
Updated pjproject packages fix security vulnerabilities
Two vulnerabilities were found in the PJSIP/PJProject communication library, which may result in denial of service (CVE-2017-9359, CVE-2017-9372).
- Record
MGASA-2017-0368- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pjprojectDebian:8 |
before 2.1.0.0.ast20130823-1+deb8u1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1 |
pjprojectMageia:5 |
before 2.3-1.1.mga5 | 2.3-1.1.mga5 |
pjprojectMageia:6 |
before 2.5.5-4.1.mga6 | 2.5.5-4.1.mga6 |
pjprojectUbuntu:14.04:LTS |
before 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1build0.14.04.1 |
pjprojectUbuntu:16.04:LTS |
before 2.1.0.0.ast20130823-1+deb8u1build0.16.04.1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1build0.16.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/863901
downloads.asterisk.org/pub/security/AST-2017-002.txt
securityfocus.com/bid/98572
debian.org/security/2017/dsa-3933
securitytracker.com/id/1038529
nvd.nist.gov/vuln/detail/CVE-2017-9372