CVE-2006-5444: Digium Asterisk

High severity, CVSS 7.5. EPSS: 86.5% chance of exploitation in the next 30 days.

Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

Affected products

• Digium Asterisk: version 0.1.7 only; version 0.1.8 only; version 0.1.9 only; version 0.1.9.1 only; version 0.2 only; version 0.3 only; …

Published 2006-10-23. Last modified 2026-06-16.