cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c8ef98b5c2
openbsd-ports/telephony/asterisk/distinfo

36 lines
2.6 KiB
Plaintext
Raw Normal View History

SECURITY update to asterisk 1.8.11.1, fixing: * A permission escalation vulnerability in Asterisk Manager Interface. This would potentially allow remote authenticated users the ability to execute commands on the system shell with the privileges of the user running the Asterisk application. * A heap overflow vulnerability in the Skinny Channel driver. The keypad button message event failed to check the length of a fixed length buffer before appending a received digit to the end of that buffer. A remote authenticated user could send sufficient keypad button message events that the buffer would be overrun. * A remote crash vulnerability in the SIP channel driver when processing UPDATE requests. If a SIP UPDATE request was received indicating a connected line update after a channel was terminated but before the final destruction of the associated SIP dialog, Asterisk would attempt a connected line update on a non-existing channel, causing a crash.
2012-04-23 17:35:58 -04:00
MD5 (asterisk-1.8.11.1.tar.gz) = /g6HhPyfAXyzYHC2Mc7l2g==
update to Asterisk 1.8.10.0 - includes the iLBC codec which now has a free copyright license; patent licensing has a "no litigation" clause (see codecs/ilbc/LICENSE_ADDENDUM) so mark as not permitted for CDs
2012-03-13 19:17:46 -04:00
MD5 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz) = KpmkXAZ1E1JVvGV5axL3xg==
MD5 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz.sha1) = HYpcpyg7903kHE+wo2ECgw==
SECURITY update to asterisk 1.8.2.1, fixes AST-2011-001 "an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information" http://downloads.asterisk.org/pub/security/AST-2011-001.html This is also a major version update to the long-term support 1.8 branch, previous versions of this diff have been tested by various ports@ readers, thanks for testing. Please review /usr/local/share/doc/asterisk/UPGRADE.txt (also note that memory use has increased). ok ajacoutot@ jasper@
2011-01-19 06:25:16 -05:00
MD5 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = VHnLTLgdZ4ME2W815JM6EQ==
MD5 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz.sha1) = euKCSaScLc2s72YD1p39Zg==
MD5 (asterisk-moh-opsound-wav-2.03.tar.gz) = gnfixpP9BWdzscFeTVIHfQ==
MD5 (asterisk-moh-opsound-wav-2.03.tar.gz.sha1) = AR+k3J/jXcPTTtVXuwQmPw==
SECURITY update to asterisk 1.8.11.1, fixing: * A permission escalation vulnerability in Asterisk Manager Interface. This would potentially allow remote authenticated users the ability to execute commands on the system shell with the privileges of the user running the Asterisk application. * A heap overflow vulnerability in the Skinny Channel driver. The keypad button message event failed to check the length of a fixed length buffer before appending a received digit to the end of that buffer. A remote authenticated user could send sufficient keypad button message events that the buffer would be overrun. * A remote crash vulnerability in the SIP channel driver when processing UPDATE requests. If a SIP UPDATE request was received indicating a connected line update after a channel was terminated but before the final destruction of the associated SIP dialog, Asterisk would attempt a connected line update on a non-existing channel, causing a crash.
2012-04-23 17:35:58 -04:00
RMD160 (asterisk-1.8.11.1.tar.gz) = XxzJRJwkPla+TXeLwmLlzZMaop4=
update to Asterisk 1.8.10.0 - includes the iLBC codec which now has a free copyright license; patent licensing has a "no litigation" clause (see codecs/ilbc/LICENSE_ADDENDUM) so mark as not permitted for CDs
2012-03-13 19:17:46 -04:00
RMD160 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz) = AZMdzpG7rRgOiu/Do8ovCaBv4cg=
RMD160 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz.sha1) = joofR4GGUm1IHe89S9oTI0Bq9Ww=
SECURITY update to asterisk 1.8.2.1, fixes AST-2011-001 "an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information" http://downloads.asterisk.org/pub/security/AST-2011-001.html This is also a major version update to the long-term support 1.8 branch, previous versions of this diff have been tested by various ports@ readers, thanks for testing. Please review /usr/local/share/doc/asterisk/UPGRADE.txt (also note that memory use has increased). ok ajacoutot@ jasper@
2011-01-19 06:25:16 -05:00
RMD160 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = aBcMdp1znWtbNbAPmZrWu/h2+fY=
RMD160 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz.sha1) = r2FBQo0Mel1qCQPV61rbSFUnkNY=
RMD160 (asterisk-moh-opsound-wav-2.03.tar.gz) = lWaXSoNgUeCPUUEt5QjZK/O+fgI=
RMD160 (asterisk-moh-opsound-wav-2.03.tar.gz.sha1) = D+hFjrIugSleLHkzLWEgvA7kjfM=
SECURITY update to asterisk 1.8.11.1, fixing: * A permission escalation vulnerability in Asterisk Manager Interface. This would potentially allow remote authenticated users the ability to execute commands on the system shell with the privileges of the user running the Asterisk application. * A heap overflow vulnerability in the Skinny Channel driver. The keypad button message event failed to check the length of a fixed length buffer before appending a received digit to the end of that buffer. A remote authenticated user could send sufficient keypad button message events that the buffer would be overrun. * A remote crash vulnerability in the SIP channel driver when processing UPDATE requests. If a SIP UPDATE request was received indicating a connected line update after a channel was terminated but before the final destruction of the associated SIP dialog, Asterisk would attempt a connected line update on a non-existing channel, causing a crash.
2012-04-23 17:35:58 -04:00
SHA1 (asterisk-1.8.11.1.tar.gz) = QBvn+ZZlvEI8uv2K5MDX12dps9s=
update to Asterisk 1.8.10.0 - includes the iLBC codec which now has a free copyright license; patent licensing has a "no litigation" clause (see codecs/ilbc/LICENSE_ADDENDUM) so mark as not permitted for CDs
2012-03-13 19:17:46 -04:00
SHA1 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz) = D5xlxz37KJGWcng50puO3TExsBw=
SHA1 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz.sha1) = QV8/mpheMVHyXJYbazVk0OfC/rk=
SECURITY update to asterisk 1.8.2.1, fixes AST-2011-001 "an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information" http://downloads.asterisk.org/pub/security/AST-2011-001.html This is also a major version update to the long-term support 1.8 branch, previous versions of this diff have been tested by various ports@ readers, thanks for testing. Please review /usr/local/share/doc/asterisk/UPGRADE.txt (also note that memory use has increased). ok ajacoutot@ jasper@
2011-01-19 06:25:16 -05:00
SHA1 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = hpL6YUI7R2nci/p4+vntXveiWbk=
SHA1 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz.sha1) = 7mrmsEnCtwUNV0J+RJd/3sI3wYE=
SHA1 (asterisk-moh-opsound-wav-2.03.tar.gz) = 9A/W6gPf6Ncq2iVAsiiL/cAGOB0=
SHA1 (asterisk-moh-opsound-wav-2.03.tar.gz.sha1) = y7b1cl1V/jLKmqKzM+N9YSXQ9Ec=
SECURITY update to asterisk 1.8.11.1, fixing: * A permission escalation vulnerability in Asterisk Manager Interface. This would potentially allow remote authenticated users the ability to execute commands on the system shell with the privileges of the user running the Asterisk application. * A heap overflow vulnerability in the Skinny Channel driver. The keypad button message event failed to check the length of a fixed length buffer before appending a received digit to the end of that buffer. A remote authenticated user could send sufficient keypad button message events that the buffer would be overrun. * A remote crash vulnerability in the SIP channel driver when processing UPDATE requests. If a SIP UPDATE request was received indicating a connected line update after a channel was terminated but before the final destruction of the associated SIP dialog, Asterisk would attempt a connected line update on a non-existing channel, causing a crash.
2012-04-23 17:35:58 -04:00
SHA256 (asterisk-1.8.11.1.tar.gz) = LJ7Z8Tle92RryYdp3GlnWFJXJ23GG1hYD7HgKAw6mO4=
update to Asterisk 1.8.10.0 - includes the iLBC codec which now has a free copyright license; patent licensing has a "no litigation" clause (see codecs/ilbc/LICENSE_ADDENDUM) so mark as not permitted for CDs
2012-03-13 19:17:46 -04:00
SHA256 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz) = eRdRl6ZRwlu2KYjnIQI+m7cRx+7yisouy6KR1D7j5mc=
SHA256 (asterisk-core-sounds-en-gsm-1.4.22.tar.gz.sha1) = ye/FmyBQU27CFiXULLsvWqivxjKK8NIIvq0rWJ8rRzI=
SECURITY update to asterisk 1.8.2.1, fixes AST-2011-001 "an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information" http://downloads.asterisk.org/pub/security/AST-2011-001.html This is also a major version update to the long-term support 1.8 branch, previous versions of this diff have been tested by various ports@ readers, thanks for testing. Please review /usr/local/share/doc/asterisk/UPGRADE.txt (also note that memory use has increased). ok ajacoutot@ jasper@
2011-01-19 06:25:16 -05:00
SHA256 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 1fAxzDHr6+yZzj/PRP+Ue9eye16VZaezphhcLRvaCUw=
SHA256 (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz.sha1) = a0BErk9wQ3/hT5gPUVL6uk6iqitdhAKMAhOrL2XHSR8=
SHA256 (asterisk-moh-opsound-wav-2.03.tar.gz) = RJ+4ENFlAsMFL+3wL353s2IGrFoUXz2s9Bd4Q6L8tTg=
SHA256 (asterisk-moh-opsound-wav-2.03.tar.gz.sha1) = Y8VUFsoRQmGrGvT9EVIyLy7GnZGrw0vEzufTKByuDZc=
SECURITY update to asterisk 1.8.11.1, fixing: * A permission escalation vulnerability in Asterisk Manager Interface. This would potentially allow remote authenticated users the ability to execute commands on the system shell with the privileges of the user running the Asterisk application. * A heap overflow vulnerability in the Skinny Channel driver. The keypad button message event failed to check the length of a fixed length buffer before appending a received digit to the end of that buffer. A remote authenticated user could send sufficient keypad button message events that the buffer would be overrun. * A remote crash vulnerability in the SIP channel driver when processing UPDATE requests. If a SIP UPDATE request was received indicating a connected line update after a channel was terminated but before the final destruction of the associated SIP dialog, Asterisk would attempt a connected line update on a non-existing channel, causing a crash.
2012-04-23 17:35:58 -04:00
SIZE (asterisk-1.8.11.1.tar.gz) = 25243311
update to Asterisk 1.8.10.0 - includes the iLBC codec which now has a free copyright license; patent licensing has a "no litigation" clause (see codecs/ilbc/LICENSE_ADDENDUM) so mark as not permitted for CDs
2012-03-13 19:17:46 -04:00
SIZE (asterisk-core-sounds-en-gsm-1.4.22.tar.gz) = 2042362
SIZE (asterisk-core-sounds-en-gsm-1.4.22.tar.gz.sha1) = 84
SECURITY update to asterisk 1.8.2.1, fixes AST-2011-001 "an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information" http://downloads.asterisk.org/pub/security/AST-2011-001.html This is also a major version update to the long-term support 1.8 branch, previous versions of this diff have been tested by various ports@ readers, thanks for testing. Please review /usr/local/share/doc/asterisk/UPGRADE.txt (also note that memory use has increased). ok ajacoutot@ jasper@
2011-01-19 06:25:16 -05:00
SIZE (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 3349898
SIZE (asterisk-extra-sounds-en-gsm-1.4.11.tar.gz.sha1) = 85
SIZE (asterisk-moh-opsound-wav-2.03.tar.gz) = 15359473
SIZE (asterisk-moh-opsound-wav-2.03.tar.gz.sha1) = 79
Reference in New Issue Copy Permalink