~ubuntu-branches/ubuntu/maverick/asterisk/maverick-security : changes

~ubuntu-branches/ubuntu/maverick/asterisk/maverick-security » Changes from revision 59

From Revision 59 to 40

Rev	Summary	Authors	Tags	Date
59	* SECURITY UPDATE: denial of service and possible code exect... * SECURITY UPDATE: denial of service and possible code exection via crafted UDPTL packet - debian/patches/AST-2011-002-1.6.2.diff: properly calculate lengths in main/udptl.c. - CVE-2011-1147 * SECURITY UPDATE: denial of service via manager session with invalid data - debian/patches/AST-2011-003-1.6.2.diff: check for errors in main/manager.c. - CVE-2011-1174 * SECURITY UPDATE: denial of service via many short TLS sessions - debian/patches/AST-2011-004-1.6.2.diff: gracefully handle failures in main/tcptls.c. - CVE-2011-1175 * SECURITY UPDATE: denial of service via a series of TCP connections - debian/patches/AST-2011-005-1.6.2.diff: add timeouts and session limits to main/manager.c, configs/manager.conf.sample, channels/chan_sip.c, channels/chan_skinny.c, main/http.c, configs/{skinny,sip,http}.conf.sample. - CVE-2011-1507 * SECURITY UPDATE: remote command execution via incomplete system privilege check - debian/patches/AST-2011-006-1.6.2.diff: correctly check privileges in main/manager.c. - CVE-2011-1599 * SECURITY UPDATE: denial of service via crafted packet and SIP channel driver - debian/patches/AST-2011-008.diff: set proper length in channels/chan_sip.c. - CVE-2011-2529 * SECURITY UPDATE: denial of service and possible code execution via IAX2 channel driver crafted frame - debian/patches/AST-2011-010-1.6.2.diff: validate options in channels/chan_iax2.c, main/features.c. - CVE-2011-2535 * SECURITY UPDATE: account name enumeration - debian/patches/AST-2011-011-1.6.2.diff: adjust responses in channels/chan_sip.c. - CVE-2011-2536	Marc Deslauriers	1:1.6.2.7-1ubuntu1.2	12 years ago
58	* SECURITY UPDATE: Stack buffer overflow in SIP channel driv... * SECURITY UPDATE: Stack buffer overflow in SIP channel driver. (LP: #705014) - debian/patches/AST-2011-001-1.6.2: The size of the output buffer passed to the ast_uri_encode function is now properly respected in main/utils.c. Patch courtesy of upstream. - CVE-2011-0495	Dave Walker (Daviey)	1:1.6.2.7-1ubuntu1.1	13 years ago
57	* Merge from debian unstable (LP: #597792), remaining change... * Merge from debian unstable (LP: #597792), remaining changes: - debian/control: + Build-depend on hardening-wrapper + Change Maintainer + Removed Uploaders field. + Removed Debian Vcs-Svn entry and replaced with ubuntu-voip Vcs-Bzr, to reflect divergence in packages. - debian/rules: Make use of hardening-wrapper - debian/asterisk.init: chown /dev/dahdi - debian/backports/hardy: add file - debian/backports/asterisk.init.hardy: add file	Lorenzo De Liso	1:1.6.2.7-1ubuntu1	13 years ago
56	* New upstream bugfix release (1.6.2.5) * New upstream bugfix release (1.6.2.5) * Security Fixes: - AST-2010-003: Invalid parsing of ACL rules can compromise security - AST-2010-002: Dialplan injection vulnerability * Remaining Ubuntu-specific changes: - debian/control: Build-depend on hardening-wrapper - debian/rules: Make use of hardening-wrapper - debian/control: Change Maintainer - debian/control: Removed Uploaders field. - debian/control: Removed Debian Vcs-Svn entry and replaced with ubuntu-voip Vcs-Bzr, to reflect divergence in packages. - debian/asterisk.init : chown /dev/dahdi - debian/backports/hardy : add file - debian/backports/asterisk.init.hardy : add file	Jean-Michel Dault	1:1.6.2.5-0ubuntu1	14 years ago
55	debian/{control,rules}: re-enable hardened options to gain P... debian/{control,rules}: re-enable hardened options to gain PIE build (Debian bug 542741, LP: #527538)	Steve Beattie	1:1.6.2.2-1ubuntu2	14 years ago
54	* Merge from Debian: security update * Merge from Debian: security update * Changes: - debian/control: Change Maintainer - debian/control: Removed Uploaders field. - debian/control: Removed Debian Vcs-Svn entry and replaced with ubuntu-voip Vcs-Bzr, to reflect divergence in packages. - debian/asterisk.init : chown /dev/dahdi - debian/backports/hardy : add file - debian/backports/asterisk.init.hardy : add file	Jean-Michel Dault	1:1.6.2.2-1ubuntu1	14 years ago
53	debian/control: remove libreadline5-dev from Depends field. debian/control: remove libreadline5-dev from Depends field.	Devid Antonio Filoni	1:1.6.2.0~rc2-0ubuntu3	14 years ago
52	[ Dave Walker (Daviey) ] [ Dave Walker (Daviey) ] * SECURITY UPDATE: ACL not respected on SIP INVITE (LP: #491632). - debian/patches/AST-2009-007: Additional check in channels/chan_sip.c to check ACL for handling SIP INVITEs. This blocks calls on networks intended to be prohibited, by configuration. Based on upstream patch. - AST-2009-007 - CVE-2009-3723 * SECURITY UPDATE: SIP responses expose valid usernames (LP: #491637). - debian/patches/AST-2009-008: Sanitise certain return of REGISTER message to stop a specially crafted series of requests returning valid usernames. Based on upstream patch. - AST-2009-008 - CVE-2009-3727 * SECURITY UPDATE: RTP Remote Crash Vulnerability (LP: #493555). - debian/patches/AST-2009-010: Stops Asterisk from crashing when an RTP comfort noise payload containing 24 bytes or greater is recieved. - AST-2009-010 - CVE-2009-4055 [ Roberto D'Auria ] * debian/patches/iax2-heavy-traffic-fix: Stops asterisk crashing on heavy traffic on iax2 channel, editing channels/chan_iax2.c. Based on upstream patch. (LP: #501116)	Roberto D'Auria	1:1.6.2.0~rc2-0ubuntu2	14 years ago
51	* New upstream version, upstream is now DFSG compliant. * New upstream version, upstream is now DFSG compliant. - ilibc has been removed upstream. - Music on Hold is now cc-by-sa. - binary firmware iaxy.bin has been removed upstream. * debian/rules: Santitised UPSTREAM variable for compatiability with Ubuntu and other variants. * debian/control: Removed Debian Vcs-Svn entry and replaced with ubuntu-voip Vcs-Bzr, to reflect divergence in packages. * patches/makefile_appdocs_dtd: Removed, merged upstream. * patches/disable_moh: Previosly disabled, removed from pool. * patches/ubuntu-banner: Ported debian-banner to display Ubuntu centric bug report information. * Refresh quilt patches	Dave Walker (Daviey)	1:1.6.2.0~rc2-0ubuntu1	14 years ago
50	debian/{control,rules}: enable hardened options to gain PIE ... debian/{control,rules}: enable hardened options to gain PIE build (Debian bug 542741).	Kees Cook	1:1.6.2.0~dfsg~beta4-0ubuntu2	14 years ago
49	* Merge from Debian. * Merge from Debian. - Lsb patches dropped: fixed upstream - Patch for LP #350732 dropped: fixed upstream * Added: - Add support for web interface - Don't enable voicetronix cards by default - Chown /dev/dahdi in init script - Add files for potential backports - Change maintainer - Standards version 3.8.3 * Debian changes [ Faidon Liambotis ] * Fix FTBFS on armel. (Closes: #532971) [ Tzafrir Cohen ] * New upstream beta. * Patch hardware_dtmf_mute_fix removed: Applied upstream. * No need for a separate app_directory_odbc (will use app_voicemail_odbc). * Fix name of voicemail 'openssl' dep. (Thomas Renard) (Closes: #539150)	Jean-Michel Dault	1:1.6.2.0~dfsg~beta4-0ubuntu1	14 years ago
48	[ Faidon Liambotis ] [ Faidon Liambotis ] * New upstream release. - Drop patches astvarrundir, pubkey_jnctn; merged upstream (finally!). - Adapt patch safe_asterisk-nobg. * Switch to downloads.asterisk.org instead of downloads.digium.com. * Add depends on libxml2-dev for the new XML documentation. * Remove Conflicts/Replaces with asterisk-classic, asterisk-bristuff, asterisk-chan-capi (<< 1.1.1-1~), since those are pre-lenny. * Revert upstream's r190830 that ported app_osplookup to OSP Toolkit 3.5; the API is not backwards compatible and Debian still has 3.4.2. * Accommodate for the rename of libcap2-dev to libcap-dev (Closes: #532971). * Add dependency to libspandsp to build the fax applications. * Update Standards-Version to 3.8.2, no changes needed. * Remove init script's "zaptel-fix" action; there's no zaptel anymore and was also lintian-buggy in its current form. * Don't include /var/run/asterisk in the package, it is created at boot-time by the init script (thanks lintian). * Remove asterisk-progdocs: it is of very limited use but a) is enormous in size and b) takes too long to build. * Re-enable and port to 1.6 the h323 segfault patch, apparently it's still needed. * Fix asterisk's Makefiles so that the openh323/libpt dependencies are added to chan_h323.so instead of the main asterisk binary. * Fix astgenkey to respect system's umask. Thanks Jonas Smedegaard. (Closes: #531730) * Create /var/log/asterisk/* directories if non-existent, for /var/log on tmpfs scenarios. Thanks martin f krafft! (Closes: #524015) * Use the lsb-base standard way of gathering and reporting status in the init script. Thanks Dustin Kirkland and Ubuntu! (Closes: #506453) * Fix debian/rules so that configure isn't called twice during a build. * Install Zaptel-to-DAHDI.txt, explains the migration procedure from Zaptel to DAHDI and is therefore useful when upgrading from lenny. [ Tzafrir Cohen ] * New upstream release. - Fixes that bashism in safe_asterisk (Closes: #530047) (not dashism). - Dropped patch astcanary_startup: merged upstream. * Patch makefile_appdocs_dtd: fix location of DTD installation. * Register the HTML docs with doc-base as well.	Faidon Liambotis	1:1.6.2.0~dfsg~beta3-1	14 years ago
47	Fix for IAX2 encrypted channels dropping out due to normal p... Fix for IAX2 encrypted channels dropping out due to normal packet loss (LP: #350732)	Francois Marier	1:1.4.21.2~dfsg-3ubuntu2	15 years ago
46	* Merge from debian unstable, remaining changes: LP: #313988 * Merge from debian unstable, remaining changes: LP: #313988 - debian/asterisk.init: Fix status action so that it returns the LSB-compliant return codes - debian/control: added lsb-base dependency for using status_of_proc.	Bhavani Shankar	1:1.4.21.2~dfsg-3ubuntu1	15 years ago
45	Build-depend on libc-client2007b-dev. Build-depend on libc-client2007b-dev.	Luca Falavigna	1:1.4.21.2~dfsg-2ubuntu2	15 years ago
44	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - debian/asterisk.init: Fix status action so that it returns the LSB-compliant return codes (Debian Bug: #) - debian/control: added lsb-base dependency for using status_of_proc; switch to libc-client2007b-dev build-dependency	Dustin Kirkland	1:1.4.21.2~dfsg-2ubuntu1	15 years ago
43	* debian/asterisk.init: Fix status action so that it returns... * debian/asterisk.init: Fix status action so that it returns the LSB-compliant return codes (LP: #248947) * debian/control: added lsb-base dependency for using status_of_proc	Thierry Carrez	1:1.4.21.2~dfsg-1ubuntu3	15 years ago
42	Switch to libc-client2007b-dev build-dependency. Switch to libc-client2007b-dev build-dependency.	Luca Falavigna	1:1.4.21.2~dfsg-1ubuntu2	15 years ago
41	* Rebuild for the libct3 -> libct4 transistion. * Rebuild for the libct3 -> libct4 transistion. * Replace libc-client2007b-dev with libc-client2007-dev in the Build-Depends.	Steve Kowalik	1:1.4.21.2~dfsg-1ubuntu1	15 years ago
40	[ Victor Seva ] [ Victor Seva ] * asterisk.postinst should always check group memberships (Closes: #486097) patch by Tim Retout <tim@retout.co.uk> * changed libc-client2007-dev to libc-client2007b-dev on Build-Depends (fixes FTBFS). [ Tzafrir Cohen ] * Depend on debhelper >= 6.0.7 due to dh_lintian (Closes: #492202). * New upstream bugfix release. Fixes CVE-2008-3263 and CVE-2008-3264. [ Faidon Liambotis ] * Do a quilt refresh on all patches. * Remove the dh_makeshlibs call as it is unneeded and generates a lintian warning.	Faidon Liambotis	1:1.4.21.2~dfsg-1	15 years ago

Older »