CVE-2014-9374
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open...
CVE-2014-9374 is a medium vulnerability (CVSS 5.0) in Digium Asterisk, published December 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.53%, the 95th percentile. Fixed in asterisk 1:13.1.0~dfsg-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 9.53%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:13.1.0~dfsg-1asterisk +1 more
Description
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 | before 1:13.1.0~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 | 1:13.1.0~dfsg-1 |
asteriskMageia:4 | before 11.14.2-1.mga4 | 11.14.2-1.mga4 |
What each source reports
NVD Score used
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
CVE-2014-9374- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
CVE-2014-9374- Updated
- 2026-11-02
EUVDEUVD-2014-9196No score
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
EUVD-2014-9196- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g26-4jfh-95vhNo score
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open...
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
GHSA-4g26-4jfh-95vh- Updated
- 2026-11-02
OSVNo score
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
CVE-2014-9374- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9374No score
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.
- Record
DEBIAN-CVE-2014-9374- Updated
- 2026-11-02
OSVMGASA-2015-0010No score
Updated asterisk packages fix CVE-2014-9374
Updated asterisk packages fix security vulnerability:
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame (CVE-2014-9374).
- Record
MGASA-2015-0010- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
advisories.mageia.org/MGASA-2015-0010.html
downloads.asterisk.org/pub/security/AST-2014-019.html
mandriva.com/security/advisories?name=MDVSA-2015:018
securityfocus.com/archive/1/534197/100/0/threaded
packetstormsecurity.com/files/129473/Asterisk-Project-Security-Advisory-AST-2014-019.html
Show 10 moreShow less
seclists.org/fulldisclosure/2014/Dec/48
secunia.com/advisories/60251
securitytracker.com/id/1031345
nvd.nist.gov/vuln/detail/CVE-2014-9374
github.com/advisories/GHSA-4g26-4jfh-95vh
security-tracker.debian.org/tracker/CVE-2014-9374
bugs.mageia.org/show_bug.cgi?id=14915
gentoo.org/security/en/glsa/glsa-201412-51.xml
Left out here: 140 versions. The JSON record has them.