CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2017/12/24 12:38:14
Modified files:
telephony/asterisk: Tag: OPENBSD_6_2 Makefile distinfo
Log message:
MFC update to Asterisk 13.18.5
AST-2017-012: Remote Crash Vulnerability in RTCP Stack
If a compound RTCP packet is received containing more than one report
(for example a Receiver Report and a Sender Report) the RTCP stack
will incorrectly store report information outside of allocated memory
potentially causing a crash.
AST-2017-014: Crash in PJSIP resource when missing a contact header
A select set of SIP messages create a dialog in Asterisk. Those SIP
messages must contain a contact header. For those messages, if the
header was not present and using the PJSIP channel driver, it would
cause Asterisk to crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication is enabled a
user would have to first be authorized before reaching the crash point.
