SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=13899

           Summary: asterisk: New release fixes four critical security
                    vulnerabilities
           Product: Codex
           Version: stable grimoire
          Platform: Other
               URL: http://www.asterisk.org/node/48367
        OS/Version: other
            Status: NEW
          Severity: critical
          Priority: P2
         Component: telephony
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: m.spitzbarth AT gmx.de


The asterisk security mailinglist has announced several vunerabilites. They 
are
fixed in version 1.4.8.

The announcements are available as pdfs from 
http://www.asterisk.org/node/48367

In short:
* Buffer overflow in the iax2 channel driver
* Another buffer overflow in the iax2 channel driver
* remotely exploitable crash vulnerability in the skinny channel driver 
(segfault)
* remotely exploitable crash vulnerability in the STUN implementation in the 
RTP
stack

I'm currently working on the update and I'll request integration to stable as
soon as the changes are pushed to git.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.