CVE-2018-7284

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.

• CWE-119

• http://downloads.asterisk.org/pub/security/AST-2018-004.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/103151Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040416Third Party Advisory, VDB Entry
• https://www.debian.org/security/2018/dsa-4320Third Party Advisory
• https://www.exploit-db.com/exploits/44184/Exploit, Third Party Advisory, VDB Entry
• http://downloads.asterisk.org/pub/security/AST-2018-004.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/103151Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040416Third Party Advisory, VDB Entry
• https://www.debian.org/security/2018/dsa-4320Third Party Advisory
• https://www.exploit-db.com/exploits/44184/Exploit, Third Party Advisory, VDB Entry

Published

Feb 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7277An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Pe…
• CVE-2018-7278An issue was discovered on RLE Protocol Converter FDS-PC / F…
• CVE-2018-7279A remote code execution issue was discovered in AlienVault U…
• CVE-2018-7280The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
• CVE-2018-7281CactusVPN 5.3.6 for macOS contains a root privilege escalati…
• CVE-2018-7282The username parameter of the TITool PrintMonitor solution d…9.8
• CVE-2018-7285A NULL pointer access issue was discovered in Asterisk 15.x …
• CVE-2018-7286An issue was discovered in Asterisk through 13.19.1, 14.x th…
• CVE-2018-7287An issue was discovered in res_http_websocket.c in Asterisk …
• CVE-2018-7289An issue was discovered in armadito-windows-driver/src/commu…
• CVE-2018-7290Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6…
• CVE-2018-7295ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and …