CVE-2017-16671

Name	CVE-2017-16671
Description	A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	881257

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	bullseye	1:16.28.0~dfsg-0+deb11u4	fixed
	bullseye (security)	1:16.28.0~dfsg-0+deb11u5	fixed
	sid	1:22.1.0~dfsg+~cs6.14.60671435-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
asterisk	source	wheezy	(not affected)
asterisk	source	jessie	(not affected)
asterisk	source	stretch	1:13.14.1~dfsg-2+deb9u3
asterisk	source	(unstable)	1:13.18.1~dfsg-1	881257

Notes

[jessie] - asterisk <not-affected> (Vulnerable code do not exist)
[wheezy] - asterisk <not-affected> (Vulnerable code do not exist)
http://downloads.digium.com/pub/security/AST-2017-010.html
http://downloads.asterisk.org/pub/security/AST-2017-010-13.diff
https://issues.asterisk.org/jira/browse/ASTERISK-27337