Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66]) by www.NetBSD.org (Postfix) with ESMTP id 92A4E63E965 for ; Thu, 3 Jan 2013 02:11:24 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id 5B58314A1D3; Thu, 3 Jan 2013 02:11:24 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 8044114A1D2 for ; Thu, 3 Jan 2013 02:11:21 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id RYK8w8U6dZ8O for ; Thu, 3 Jan 2013 02:11:20 +0000 (UTC) Received: from cvs.netbsd.org (cvs.NetBSD.org [IPv6:2001:4f8:3:7:2e0:81ff:fe30:95bd]) by mail.netbsd.org (Postfix) with ESMTP id 9FFB314A188 for ; Thu, 3 Jan 2013 02:11:20 +0000 (UTC) Received: by cvs.netbsd.org (Postfix, from userid 500) id 10D33175DD; Thu, 3 Jan 2013 02:11:20 +0000 (UTC) Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" MIME-Version: 1.0 Date: Thu, 3 Jan 2013 02:11:19 +0000 From: "John Nemeth" Subject: CVS commit: pkgsrc/comms/asterisk To: pkgsrc-changes@NetBSD.org Reply-To: jnemeth@netbsd.org X-Mailer: log_accum Message-Id: <20130103021120.10D33175DD@cvs.netbsd.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk Module Name: pkgsrc Committed By: jnemeth Date: Thu Jan 3 02:11:19 UTC 2013 Modified Files: pkgsrc/comms/asterisk: Makefile distinfo Log Message: Upgrade to Asterisk 11.1.1; this is a security fix to fix AST-2012-14 and AST-2012-015. Approved for commit during freeze by: agc The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.11 and Asterisk 1.8, 10, and 11. The available security releases are released as versions 1.8.11-cert10, 1.8.19.1, 10.11.1, 10.11.1-digiumphones, and 11.1.1. The release of these versions resolve the following two issues: * Stack overflows that occur in some portions of Asterisk that manage a TCP connection. In SIP, this is exploitable via a remote unauthenticated session; in XMPP and HTTP connections, this is exploitable via remote authenticated sessions. * A denial of service vulnerability through exploitation of the device state cache. Anonymous calls had the capability to create devices in Asterisk that would never be disposed of. These issues and their resolutions are described in the security advisories. For more information about the details of these vulnerabilities, please read security advisories AST-2012-014 and AST-2012-015, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.1.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2012-014.pdf * http://downloads.asterisk.org/pub/security/AST-2012-015.pdf Thank you for your continued support of Asterisk! To generate a diff of this commit: cvs rdiff -u -r1.77 -r1.78 pkgsrc/comms/asterisk/Makefile cvs rdiff -u -r1.50 -r1.51 pkgsrc/comms/asterisk/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.