Unrated severityNVD Advisory· Published Dec 9, 2008· Updated Apr 23, 2026

CVE-2008-5396

Description

Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to missing validation of the sync field associated with the ZT_SPANCONFIG ioctl.

Affected products

Asterisk/Zaptel4 versions
cpe:2.3:a:asterisk:zaptel:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:asterisk:zaptel:*:*:*:*:*:*:*:*range: <=1.4.11
- cpe:2.3:a:asterisk:zaptel:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:asterisk:zaptel:1.2.27:*:*:*:*:*:*:*
- cpe:2.3:a:asterisk:zaptel:1.4:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

bugs.debian.org/cgi-bin/bugreport.cginvd
bugs.digium.com/view.phpnvd
secunia.com/advisories/32947nvd
secunia.com/advisories/32960nvd
www.openwall.com/lists/oss-security/2008/12/03/10nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000