---------- Forwarded message ---------- From: Asterisk Development Team Date: Thursday, March 15, 2012 Subject: [asterisk-dev] Asterisk 1.4.44, 1.6.2.23, 1.8.10.1, 10.2.1 Now Available (Security Releases) To: asterisk-...@lists.digium.com
The Asterisk Development Team has announced security releases for Asterisk 1.4, 1.6.2, 1.8, and 10. The available security releases are released as versions 1.4.44, 1.6.2.23, 1.8.10.1, and 10.2.1. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of Asterisk 1.4.44 and 1.6.2.23 resolve an issue wherein app_milliwatt can potentially overrun a buffer on the stack, causing Asterisk to crash. This does not have the potential for remote code execution. The release of Asterisk 1.8.10.1 and 10.2.1 resolve two issues. First, they resolve the issue in app_milliwatt, wherein a buffer can potentially be overrun on the stack, but no remote code execution is possible. Second, they resolve an issue in HTTP AMI where digest authentication information can be used to overrun a buffer on the stack, allowing for code injection and execution. These issues and their resolution are described in the security advisory. For more information about the details of these vulnerabilities, please read the security advisories AST-2012-002 and AST-2012-003, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.4.44 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.23 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.10.1 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.2.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2012-002.pdf * http://downloads.asterisk.org/pub/security/AST-2012-003.pdf Thank you for your continued support of Asterisk! -- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- asterisk-dev mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-dev
_______________________________________________ KHOMP Inovação: External Board Series Módulos de 1/2 rack e 1U para todas as interfaces e soluções Asterisk e FreeSWITCH. Tenha a External Series Experience na sua aplicação. Visite www.khomp.com _______________________________________________ DIGIVOICE: Lider no mercado de placas para Asterisk Único fabricante com Centro de Treinamento especializado. LANÇAMENTO: Channel Bank TDMoE, até 64 canais FXS / FXO. www.digivoice.com.br ou (11)3016-5200. ________ YEALINK: Telefones IP e VídeoPhones IP com o melhor custo/benefício do mercado. email: yeal...@commlogik.com.br | www.commlogik.com.br | (11) 5503-1011 ______________________________________________ Para remover seu email desta lista, basta enviar um email em branco para asteriskbrasil-unsubscr...@listas.asteriskbrasil.org
