CVE-2017-16672

An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.

• CWE-772

• http://downloads.digium.com/pub/security/AST-2017-011.htmlVendor Advisory
• http://www.securityfocus.com/bid/101765Third Party Advisory, VDB Entry
• https://issues.asterisk.org/jira/browse/ASTERISK-27345Vendor Advisory
• https://security.gentoo.org/glsa/201811-11
• https://www.debian.org/security/2017/dsa-4076
• http://downloads.digium.com/pub/security/AST-2017-011.htmlVendor Advisory
• http://www.securityfocus.com/bid/101765Third Party Advisory, VDB Entry
• https://issues.asterisk.org/jira/browse/ASTERISK-27345Vendor Advisory
• https://security.gentoo.org/glsa/201811-11
• https://www.debian.org/security/2017/dsa-4076

Published

Nov 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16665RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable t…
• CVE-2017-16666Xplico before 1.2.1 allows remote authenticated users to exe…
• CVE-2017-16667backintime (aka Back in Time) before 1.1.24 did improper esc…
• CVE-2017-16669coders/wpg.c in GraphicsMagick 1.3.26 allows remote attacker…
• CVE-2017-16670The project import functionality in SoapUI 5.3.0 allows remo…
• CVE-2017-16671A Buffer Overflow issue was discovered in Asterisk Open Sour…
• CVE-2017-16673Datto Backup Agent 1.0.6.0 and earlier does not authenticate…
• CVE-2017-16674Datto Windows Agent allows unauthenticated remote command ex…
• CVE-2017-16678Server Side Request Forgery (SSRF) vulnerability in SAP NetW…
• CVE-2017-16679URL redirection vulnerability in SAP's Startup Service, SAP …
• CVE-2017-1668IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could all…
• CVE-2017-16680Two potential audit log injections in SAP HANA extended appl…