Bug#704114: asterisk: asterisk security advisories: AST-2013-001 / AST-2013-002 / AST-2013-003
tzafrir.cohen at xorcom.com
Thu Mar 28 07:37:30 UTC 2013
On Thu, Mar 28, 2013 at 06:23:32AM +0100, Salvatore Bonaccorso wrote:
> Package: asterisk
> Severity: grave
> Tags: security patch upstream
> the following vulnerabilities were published for asterisk.
> Buffer Overflow Exploit Through SIP SDP Header
> Denial of Service in HTTP server
> Username disclosure in SIP channel driver
> For CVE-2013-2685 the tracker mentions only 1.11.x. Could you
> doublecheck that squeeze, testing and wheezy are not affected?
According to the Upstream advisories, both are in effect for 1.8 .
Didn't yet check backporting it (to our 1.8 in Testing/Unstable) and to
1.6.2 in Stable.
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> For further information see:
>  http://security-tracker.debian.org/tracker/CVE-2013-2685
>  http://security-tracker.debian.org/tracker/CVE-2013-2686
>  http://security-tracker.debian.org/tracker/CVE-2013-2264
>  https://issues.asterisk.org/jira/browse/ASTERISK-20901
> Please adjust the affected versions in the BTS as needed.
icq#16849755 jabber:tzafrir.cohen at xorcom.com
+972-50-7952406 mailto:tzafrir.cohen at xorcom.com
http://www.xorcom.com iax:guest at local.xorcom.com/tzafrir
More information about the Pkg-voip-maintainers