Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-05 Thread Moritz Muehlenhoff
On Mon, Oct 05, 2009 at 03:02:55PM +0300, Faidon Liambotis wrote: > Moritz Muehlenhoff wrote: > >> You are right that we should do an update for a point release of lenny > >> though to address a minor information disclosure vulnerability[1], plus > >> some other non-security related bugs. However,

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-05 Thread Faidon Liambotis
Moritz Muehlenhoff wrote: >> You are right that we should do an update for a point release of lenny >> though to address a minor information disclosure vulnerability[1], plus >> some other non-security related bugs. However, I'd like to avoid >> upgrading to a newer 1.4.x release but backport chang

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-10-04 Thread Moritz Muehlenhoff
Sorry for the late followup, I've been on vacation. On Wed, Sep 16, 2009 at 11:21:39PM +0300, Faidon Liambotis wrote: > Hi, > > Moritz Muehlenhoff wrote: > > Asterisk maintainers, what should be done about stable? Would it > > make sense to update the stable version to 1.4.26.2 in a point update?

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-09-16 Thread Faidon Liambotis
Hi, Moritz Muehlenhoff wrote: > Asterisk maintainers, what should be done about stable? Would it > make sense to update the stable version to 1.4.26.2 in a point update? > (IIRC there's still a performance regression affecting Lenny from > a previous security update?) This particular vulnerability

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-09-16 Thread Moritz Muehlenhoff
On Sat, Aug 01, 2009 at 10:57:33AM +0200, Giuseppe Iuculano wrote: > Package: asterisk > Version: 1:1.6.2.0~dfsg~beta3-1 > Severity: serious > Tags: security patch > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > Hi, > the following CVE (Common Vulnerabilities & Exposures) id was > publ

Bug#539473: CVE-2009-2651: Remote Crash Vulnerability in RTP stack

2009-08-01 Thread Giuseppe Iuculano
Package: asterisk Version: 1:1.6.2.0~dfsg~beta3-1 Severity: serious Tags: security patch -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for asterisk. CVE-2009-2651[0]: | main/rtp.c in Asterisk Open Source 1.6.1 before 1.