[AsteriskBrasil] Fwd: [asterisk-dev] Asterisk 1.4.44, 1.6.2.23, 1.8.10.1, 10.2.1 Now Available (Security Releases)

[Denis Galvão]

---------- Forwarded message ----------
From: Asterisk Development Team
Date: Thursday, March 15, 2012
Subject: [asterisk-dev] Asterisk 1.4.44, 1.6.2.23, 1.8.10.1, 10.2.1 Now
Available (Security Releases)
To: asterisk-dev em lists.digium.com


The Asterisk Development Team has announced security releases for Asterisk
1.4,
1.6.2, 1.8, and 10. The available security releases are released as versions
1.4.44, 1.6.2.23, 1.8.10.1, and 10.2.1.

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.4.44 and 1.6.2.23 resolve an issue wherein
app_milliwatt
can potentially overrun a buffer on the stack, causing Asterisk to crash.
 This
does not have the potential for remote code execution.

The release of Asterisk 1.8.10.1 and 10.2.1 resolve two issues.  First, they
resolve the issue in app_milliwatt, wherein a buffer can potentially be
overrun
on the stack, but no remote code execution is possible.  Second, they
resolve
an issue in HTTP AMI where digest authentication information can be used to
overrun a buffer on the stack, allowing for code injection and execution.

These issues and their resolution are described in the security advisory.

For more information about the details of these vulnerabilities, please
read the
security advisories AST-2012-002 and AST-2012-003, which were released at
the same
time as this announcement.

For a full list of changes in the current releases, please see the
ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.4.44
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.23
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.10.1
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.2.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2012-002.pdf
 * http://downloads.asterisk.org/pub/security/AST-2012-003.pdf

Thank you for your continued support of Asterisk!




--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-dev mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-dev
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: http://listas.asteriskbrasil.org/pipermail/asteriskbrasil/attachments/20120316/6f0834e8/attachment.htm