Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-03-25 Thread Salvatore Bonaccorso
Hi On Sat, Mar 09, 2013 at 07:20:44PM +0100, Salvatore Bonaccorso wrote: Hi Tzafrir! Are there news on this? I have noticed that in the svn repository for asterisk there is already: asterisk (1:1.8.13.1~dfsg-2) unstable; urgency=high * Patches backported from Asterisk 1.8.19.1

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-03-09 Thread Salvatore Bonaccorso
Hi Tzafrir! Are there news on this? I have noticed that in the svn repository for asterisk there is already: asterisk (1:1.8.13.1~dfsg-2) unstable; urgency=high * Patches backported from Asterisk 1.8.19.1 (Closes: #697230): - Patch AST-2012-014 (CVE-2012-5976) - fixes Crashes due to

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-03-08 Thread Christian Staake
Hello, why has this bug been marked as not found in the version in sid again? I can't see a new version of the package in the repository and it's still listed as vulnerable on security-tracker.debian.org. As I'm currently using the version from squeeze-backports, I'd really like to see this

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-03-01 Thread Moritz Muehlenhoff
found 697230 1:1.8.13.1~dfsg-1 thanks On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package: asterisk Severity: grave Tags: security Justification: user security hole -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, the following vulnerabilities were

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-14 Thread Tzafrir Cohen
On Fri, Jan 11, 2013 at 11:00:30PM +, Tzafrir Cohen wrote: On Tue, Jan 08, 2013 at 06:49:56PM +0100, Moritz Mühlenhoff wrote: On Tue, Jan 08, 2013 at 02:45:59AM +0200, Tzafrir Cohen wrote: Hi, On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package:

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-14 Thread Javier Serrano Polo
AST-2012-014: b/channels/chan_sip.c @@ -3078,7 +3079,7 @@ static void *_sip_tcp_helper_thread(stru req.socket.fd = tcptls_session-fd; /* Read in headers one line at a time */ - while (req.len 4 ||

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-14 Thread Tzafrir Cohen
On Mon, Jan 14, 2013 at 04:02:22PM +0100, Javier Serrano Polo wrote: AST-2012-014: b/channels/chan_sip.c @@ -3078,7 +3079,7 @@ static void *_sip_tcp_helper_thread(stru req.socket.fd = tcptls_session-fd; /* Read in headers one line at a time */

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-11 Thread Tzafrir Cohen
On Tue, Jan 08, 2013 at 06:49:56PM +0100, Moritz Mühlenhoff wrote: On Tue, Jan 08, 2013 at 02:45:59AM +0200, Tzafrir Cohen wrote: Hi, On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package: asterisk Severity: grave Tags: security Justification: user

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-08 Thread Moritz Mühlenhoff
On Tue, Jan 08, 2013 at 02:45:59AM +0200, Tzafrir Cohen wrote: Hi, On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package: asterisk Severity: grave Tags: security Justification: user security hole -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi,

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-07 Thread Tzafrir Cohen
On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package: asterisk Severity: grave Tags: security Justification: user security hole -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, the following vulnerabilities were published for asterisk. CVE-2012-5976[0]:

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-07 Thread Tzafrir Cohen
Hi, On Wed, Jan 02, 2013 at 10:56:43PM +0100, Salvatore Bonaccorso wrote: Package: asterisk Severity: grave Tags: security Justification: user security hole -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, the following vulnerabilities were published for asterisk.

Bug#697230: asterisk: Two security issues: AST-2012-014 / AST-2012-015

2013-01-02 Thread Salvatore Bonaccorso
Package: asterisk Severity: grave Tags: security Justification: user security hole -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, the following vulnerabilities were published for asterisk. CVE-2012-5976[0]: Crashes due to large stack allocations when using TCP CVE-2012-5977[1]: Denial of