diff options
| author | flo <flo@FreeBSD.org> | 2011-01-19 16:46:28 +0800 |
|---|---|---|
| committer | flo <flo@FreeBSD.org> | 2011-01-19 16:46:28 +0800 |
| commit | c0b012a8a4b7a916703a6b8f210170e50963fc16 (patch) | |
| tree | 984a9ebf5698c660432187087a7cf105f030b096 | |
| parent | a91be60e7ad8276e1979dabe6cb608437a852d10 (diff) | |
| download | freebsd-ports-gnome-c0b012a8a4b7a916703a6b8f210170e50963fc16.tar.gz freebsd-ports-gnome-c0b012a8a4b7a916703a6b8f210170e50963fc16.tar.zst freebsd-ports-gnome-c0b012a8a4b7a916703a6b8f210170e50963fc16.zip | |
- Document Exploitable Stack Buffer Overflow in asterisk
Approved by: fjoe (mentor)
Feature safe: yes
| -rw-r--r-- | security/vuxml/vuln.xml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e4d0ac826b30..15005b79e56a 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,45 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30"> + <topic>asterisk -- Exploitable Stack Buffer Overflow</topic> + <affects> + <package> + <name>asterisk14</name> + <range><gt>1.4.*</gt><lt>1.4.39.1</lt></range> + </package> + <package> + <name>asterisk16</name> + <range><gt>1.6.*</gt><lt>1.6.16.1</lt></range> + </package> + <package> + <name>asterisk18</name> + <range><gt>1.8.*</gt><lt>1.8.2.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Asterisk Development Team reports:</p> + <blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html"> + <p>The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, + 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an + outgoing SIP request while in pedantic mode, which can cause a stack + buffer to be made to overflow if supplied with carefully crafted + caller ID information. The issue and resolution are described in the + AST-2011-001 security advisory.</p> + </blockquote> + </body> + </description> + <references> + <url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url> + </references> + <dates> + <discovery>2011-01-18</discovery> + <entry>2011-01-19</entry> + </dates> + </vuln> + + <vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8"> <topic>tarsnap -- cryptographic nonce reuse</topic> <affects> |