CVE catalog

CVE-2007-1595

DEBIAN-

The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.

Severity: Unknown
Published: Mar 22, 2007, 11:19:00 PM UTC
Updated: Sep 28, 2026, 6:47:32 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.69% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debian14	asterisk	`1:1.4.0~dfsg-1`	Fixed	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC

Showing 1 fix observations. All 67 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debian14	asterisk	`0.1.11-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`0.1.11-3woody1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.5-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.5-4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.6-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.6-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge5`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.7.dfsg.1-2sarge6`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.9.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.9.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.9.dfsg-4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.9.dfsg-5`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.0.9.dfsg-6`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-beta1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-beta2.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-beta2.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-beta2.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-rc1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0-rc2.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-5`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.0.dfsg-6`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.1.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.1.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.10.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.10.dfsg-1bpo1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.10.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.10.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.11.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.12.1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-2etch1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-2etch2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-2etch3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.13~dfsg-2etch4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.14~dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.14~dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.14~dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.14~dfsg-4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.15~dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.16~dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.17~dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-4`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-5`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-6`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-6+b1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.4.dfsg-7`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.7.1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.7.1.dfsg-2`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.7.1.dfsg-3`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.2.9.1.dfsg-1`	Affected	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC
Debian14	asterisk	`1:1.4.0~dfsg-1`	Fixed	[DEBIAN-CVE-2007-1595]Oct 21, 2026, 5:47:36 PM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "asterisk",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:1.4.0~dfsg-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "0.1.11-3",
        "0.1.11-3woody1",
        "1:1.0.5-2",
        "1:1.0.5-4",
        "1:1.0.6-1",
        "1:1.0.6-2",
        "1:1.0.7-1",
        "1:1.0.7.dfsg.1-1",
        "1:1.0.7.dfsg.1-2",
        "1:1.0.7.dfsg.1-2sarge1",
        "1:1.0.7.dfsg.1-2sarge2",
        "1:1.0.7.dfsg.1-2sarge3",
        "1:1.0.7.dfsg.1-2sarge4",
        "1:1.0.7.dfsg.1-2sarge5",
        "1:1.0.7.dfsg.1-2sarge6",
        "1:1.0.9.dfsg-1",
        "1:1.0.9.dfsg-3",
        "1:1.0.9.dfsg-4",
        "1:1.0.9.dfsg-5",
        "1:1.0.9.dfsg-6",
        "1:1.2.0-beta1.dfsg-1",
        "1:1.2.0-beta2.dfsg-1",
        "1:1.2.0-beta2.dfsg-2",
        "1:1.2.0-beta2.dfsg-3",
        "1:1.2.0-rc1.dfsg-1",
        "1:1.2.0-rc2.dfsg-1",
        "1:1.2.0.dfsg-1",
        "1:1.2.0.dfsg-2",
        "1:1.2.0.dfsg-3",
        "1:1.2.0.dfsg-4",
        "1:1.2.0.dfsg-5",
        "1:1.2.0.dfsg-6",
        "1:1.2.1.dfsg-1",
        "1:1.2.1.dfsg-2",
        "1:1.2.1.dfsg-3",
        "1:1.2.10.dfsg-1",
        "1:1.2.10.dfsg-1bpo1",
        "1:1.2.10.dfsg-2",
        "1:1.2.10.dfsg-3",
        "1:1.2.11.dfsg-1",
        "1:1.2.12.1.dfsg-1",
        "1:1.2.13~dfsg-1",
        "1:1.2.13~dfsg-2",
        "1:1.2.13~dfsg-2etch1",
        "1:1.2.13~dfsg-2etch2",
        "1:1.2.13~dfsg-2etch3",
        "1:1.2.13~dfsg-2etch4",
        "1:1.2.14~dfsg-1",
        "1:1.2.14~dfsg-2",
        "1:1.2.14~dfsg-3",
        "1:1.2.14~dfsg-4",
        "1:1.2.15~dfsg-1",
        "1:1.2.16~dfsg-1",
        "1:1.2.17~dfsg-1",
        "1:1.2.4.dfsg-1",
        "1:1.2.4.dfsg-2",
        "1:1.2.4.dfsg-3",
        "1:1.2.4.dfsg-4",
        "1:1.2.4.dfsg-5",
        "1:1.2.4.dfsg-6",
        "1:1.2.4.dfsg-6+b1",
        "1:1.2.4.dfsg-7",
        "1:1.2.7.1.dfsg-1",
        "1:1.2.7.1.dfsg-2",
        "1:1.2.7.1.dfsg-3",
        "1:1.2.9.1.dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2007-1595",
      "fixed_version": "1:1.4.0~dfsg-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2007-1595",
      "provider_updated_at": "2026-10-21T17:47:36.925767092Z"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 23, 2026, 5:03:32 PM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2007-1595]

[FIRST EPSS] · [OSV Package Vulnerability Database]