CVE-2017-9359
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x...
CVE-2017-9359 is a high vulnerability (CVSS 7.5) in Digium Certified Asterisk, published June 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.80%, the 90th percentile. Fixed in pjproject 2.1.0.0.ast20130823-1+deb8u1.
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
CVE-2017-9359- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
CVE-2017-9359- Updated
- 2026-11-02
EUVDEUVD-2017-18294 No score
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
EUVD-2017-18294- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7x89-2pm4-68r8
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x...
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
GHSA-7x89-2pm4-68r8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
CVE-2017-9359- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9359
The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
- Record
UBUNTU-CVE-2017-9359- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0368 No score
Updated pjproject packages fix security vulnerabilities
Two vulnerabilities were found in the PJSIP/PJProject communication library, which may result in denial of service (CVE-2017-9359, CVE-2017-9372).
- Record
MGASA-2017-0368- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pjprojectDebian:8 |
before 2.1.0.0.ast20130823-1+deb8u1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1 |
pjprojectMageia:5 |
before 2.3-1.1.mga5 | 2.3-1.1.mga5 |
pjprojectMageia:6 |
before 2.5.5-4.1.mga6 | 2.5.5-4.1.mga6 |
pjprojectUbuntu:14.04:LTS |
before 2.1.0.0.ast20130823-1+deb8u1build0.14.04.1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1build0.14.04.1 |
pjprojectUbuntu:16.04:LTS |
before 2.1.0.0.ast20130823-1+deb8u1build0.16.04.1, plus listed versions 2.1.0.0.ast20130823-1 |
2.1.0.0.ast20130823-1+deb8u1build0.16.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/863902
downloads.asterisk.org/pub/security/AST-2017-003.txt
issues.asterisk.org/jira/browse/ASTERISK-26939
securityfocus.com/bid/98578
debian.org/security/2017/dsa-3933
nvd.nist.gov/vuln/detail/CVE-2017-9359