CVE-2014-9374

描述

Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.

如何修補 CVE-2014-9374

要修補 CVE-2014-9374,請將受影響套件升級到下列已修補版本。

• Debian/asterisk—升級至 1:13.1.0~dfsg-1 或更新版本

CVE-2014-9374 正在被利用嗎?

中等 — EPSS 為 9.5%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1:13.1.0~dfsg-1

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-9374