full-disclosure

Open Source and information security mailing list archives

Message-Id: <E1eKsgO-0002ad-JX@mail.digium.com>
Date: Fri, 01 Dec 2017 15:17:16 -0600
From: "Asterisk Security Team" <security@...erisk.org>
To: fulldisclosure@...lists.org
Subject: [FD] :

The Asterisk Development Team has announced security releases for
Certified Asterisk 13.13 and Asterisk 13, 14 and 15.  The available
security releases are released as versions 13.13-cert8, 13.18.3,
14.7.3 and 15.1.3.

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of these versions resolves the following security
vulnerabilities:

* AST-2017-013: DOS Vulnerability in Asterisk chan_skinny
  If the chan_skinny (AKA SCCP protocol) channel driver is  
  flooded with certain requests it can cause the asterisk   
  process to use excessive amounts of virtual memory        
  eventually causing asterisk to stop processing requests of
  any kind.                                                 

For a full list of changes in the current releases, please see the
ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.3
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog=14.7.3
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.3
http://downloads.asterisk.org/pub/telephony/certified-asterisk/ChangeLog-certified-13.13-cert8

The security advisories are available at:
http://downloads.asterisk.org/pub/security/AST-2017-013.pdf

Thank you for your continued support of Asterisk!

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives