Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-05 Thread Faidon Liambotis
Moritz Muehlenhoff wrote: You are right that we should do an update for a point release of lenny though to address a minor information disclosure vulnerability[1], plus some other non-security related bugs. However, I'd like to avoid upgrading to a newer 1.4.x release but backport changes

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-05 Thread Moritz Muehlenhoff
On Mon, Oct 05, 2009 at 03:02:55PM +0300, Faidon Liambotis wrote: Moritz Muehlenhoff wrote: You are right that we should do an update for a point release of lenny though to address a minor information disclosure vulnerability[1], plus some other non-security related bugs. However, I'd like

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-04 Thread Moritz Muehlenhoff
Sorry for the late followup, I've been on vacation. On Wed, Sep 16, 2009 at 11:21:39PM +0300, Faidon Liambotis wrote: Hi, Moritz Muehlenhoff wrote: Asterisk maintainers, what should be done about stable? Would it make sense to update the stable version to 1.4.26.2 in a point update?

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-09-16 Thread Moritz Muehlenhoff
On Sat, Aug 01, 2009 at 10:57:33AM +0200, Giuseppe Iuculano wrote: Package: asterisk Version: 1:1.6.2.0~dfsg~beta3-1 Severity: serious Tags: security patch -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, the following CVE (Common Vulnerabilities Exposures) id was published for

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-09-16 Thread Faidon Liambotis
Hi, Moritz Muehlenhoff wrote: Asterisk maintainers, what should be done about stable? Would it make sense to update the stable version to 1.4.26.2 in a point update? (IIRC there's still a performance regression affecting Lenny from a previous security update?) This particular vulnerability

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-08-01 Thread Giuseppe Iuculano
Package: asterisk Version: 1:1.6.2.0~dfsg~beta3-1 Severity: serious Tags: security patch -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, the following CVE (Common Vulnerabilities Exposures) id was published for asterisk. CVE-2009-2651[0]: | main/rtp.c in Asterisk Open Source 1.6.1 before