diff options
| author | madpilot <madpilot@FreeBSD.org> | 2017-12-23 17:55:08 +0800 |
|---|---|---|
| committer | madpilot <madpilot@FreeBSD.org> | 2017-12-23 17:55:08 +0800 |
| commit | c13241d82405090047b69a97a9429f1c1eb0290c (patch) | |
| tree | 977f52415b887e7a03cc4102dc3fd46ded36b4f8 /security | |
| parent | d642c858f08629c44a17016f1fff8e6ed87ce3a6 (diff) | |
| download | freebsd-ports-gnome-c13241d82405090047b69a97a9429f1c1eb0290c.tar.gz freebsd-ports-gnome-c13241d82405090047b69a97a9429f1c1eb0290c.tar.zst freebsd-ports-gnome-c13241d82405090047b69a97a9429f1c1eb0290c.zip | |
Document new asterisk vulnerability.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 6b1acf7adeab..25ff6a5c0313 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b"> + <topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic> + <affects> + <package> + <name>asterisk13</name> + <range><lt>13.18.5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Asterisk project reports:</p> + <blockquote cite="https://www.asterisk.org/downloads/security-advisories"> + <p>A select set of SIP messages create a dialog in Asterisk. + Those SIP messages must contain a contact header. For + those messages, if the header was not present and using + the PJSIP channel driver, it would cause Asterisk to + crash. The severity of this vulnerability is somewhat + mitigated if authentication is enabled. If authentication + is enabled a user would have to first be authorized before + reaching the crash point.</p> + </blockquote> + </body> + </description> + <references> + <url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url> + <cvename>CVE-2017-17850</cvename> + </references> + <dates> + <discovery>2017-12-12</discovery> + <entry>2017-12-23</entry> + </dates> + </vuln> + <vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf"> <topic>MariaDB -- unspecified vulnerability</topic> <affects> |