Vulnerability DatabaseCVE-2014-2289
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2014-2289
Published:April 18, 2014
Updated:May 17, 2026
res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.
Related Resources (6)
http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
https://issues.asterisk.org/jira/browse/ASTERISK-23139
https://people.canonical.com/~ubuntu-security/cve/CVE-2014-2289
http://downloads.asterisk.org/pub/security/AST-2014-004.html
Do you need more information?
Contact Us
CVSS v3
Base Score:
3.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
CVSS v2
Base Score:
3.5
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Weakness Type (CWE)
Improper Input Validation
CWE-20
EPSS
Base Score:
3.70