summaryrefslogtreecommitdiff
path: root/comms/asterisk
AgeCommit message (Collapse)AuthorFilesLines
2016-04-11Recursive revbump from textproc/icu 57.1ryoon1-2/+2
2016-03-05Bump PKGREVISION for security/openssl ABI bump.jperkin1-1/+2
2016-02-25Use OPSYSVARS.jperkin1-5/+3
2016-02-07Update to Asterisk 11.21.1: this is mainly a bug patch update plusjnemeth4-45/+47
fixes for AST-2016-001, AST-2016-002, and AST-2016-003. Also some pkglinting. ----- 11.21.1 The Asterisk Development Team has announced security releases for Certified Asterisk 11.6 and 13.1 and Asterisk 11 and 13. The available security releases are released as versions 11.6-cert12, 11.21.1, 13.1-cert3, and 13.7.1. The release of these versions resolves the following security vulnerabilities: * AST-2016-001: BEAST vulnerability in HTTP server The Asterisk HTTP server currently has a default configuration which allows the BEAST vulnerability to be exploited if the TLS functionality is enabled. This can allow a man-in-the-middle attack to decrypt data passing through it. * AST-2016-002: File descriptor exhaustion in chan_sip Setting the sip.conf timert1 value to a value higher than 1245 can cause an integer overflow and result in large retransmit timeout times. These large timeout values hold system file descriptors hostage and can cause the system to run out of file descriptors. * AST-2016-003: Remote crash vulnerability receiving UDPTL FAX data. If no UDPTL packets are lost there is no problem. However, a lost packet causes Asterisk to use the available error correcting redundancy packets. If those redundancy packets have zero length then Asterisk uses an uninitialized buffer pointer and length value which can cause invalid memory accesses later when the packet is copied. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.21.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2016-001.pdf * http://downloads.asterisk.org/pub/security/AST-2016-002.pdf * http://downloads.asterisk.org/pub/security/AST-2016-003.pdf Thank you for your continued support of Asterisk! ----- 11.21.0 The Asterisk Development Team has announced the release of Asterisk 11.21.0. The release of Asterisk 11.21.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-25640 - pbx: Deadlock on features reload and state change hint. (Reported by Krzysztof Trempala) * ASTERISK-25364 - [patch]Issue a TCP connection(kernel) and thread of asterisk is not released (Reported by Hiroaki Komatsu) * ASTERISK-25569 - app_meetme: Audio quality issues (Reported by Corey Farrell) * ASTERISK-25609 - [patch]Asterisk may crash when calling ast_channel_get_t38_state(c) (Reported by Filip Jenicek) * ASTERISK-24146 - [patch]No audio on WebRtc caller side when answer waiting time is more than ~7sec (Reported by Aleksei Kulakov) * ASTERISK-25599 - [patch] SLIN Resampling Codec only 80 msec (Reported by Alexander Traud) * ASTERISK-25616 - Warning with a Codec Module which supports PLC with FEC (Reported by Alexander Traud) * ASTERISK-25610 - Asterisk crash during "sip reload" (Reported by Dudás József) * ASTERISK-25498 - Asterisk crashes when negotiating g729 without that module installed (Reported by Ben Langfeld) * ASTERISK-25476 - chan_sip loses registrations after a while (Reported by Michael Keuter) * ASTERISK-25593 - fastagi: record file closed after sending result (Reported by Kevin Harwell) * ASTERISK-25585 - [patch]rasterisk never hits most of main(), but it's assumed to (Reported by Walter Doekes) * ASTERISK-25552 - hashtab: Improve NULL tolerance (Reported by Joshua Colp) * ASTERISK-25449 - main/sched: Regression introduced by 5c713fdf18f causes erroneous duplicate RTCP messages; other potential scheduling issues in chan_sip/chan_skinny (Reported by Matt Jordan) * ASTERISK-25537 - [patch] format-attribute module: RFC or internal defaults? (Reported by Alexander Traud) * ASTERISK-25373 - add documentation for CALLERID(pres) and also the CONNECTEDLINE and REDIRECTING variants (Reported by Walter Doekes) * ASTERISK-25527 - Quirky xmldoc description wrapping (Reported by Walter Doekes) * ASTERISK-25434 - Compiler flags not reported in 'core show settings' despite usage during compilation (Reported by Rusty Newton) * ASTERISK-25494 - build: GCC 5.1.x catches some new const, array bounds and missing paren issues (Reported by George Joseph) * ASTERISK-7803 - [patch] Update the maximum packetization values in frame.c (Reported by dea) * ASTERISK-25461 - Nested dialplan #includes don't work as expected. (Reported by Richard Mudgett) * ASTERISK-25455 - Deadlock of PJSIP realtime over res_config_pgsql (Reported by mdu113) * ASTERISK-25135 - [patch]RTP Timeout hangup cause code missing (Reported by Olle Johansson) * ASTERISK-25400 - Hints broken when "CustomPresence" doesn't exist in AstDB (Reported by Andrew Nagy) * ASTERISK-25443 - [patch]IPv6 - Potential issue in via header parsing (Reported by ffs) * ASTERISK-25391 - AMI GetConfigJSON returns invalid JSON (Reported by Bojan Nemčić) * ASTERISK-25438 - res_rtp_asterisk: ICE role message even when ICE is not enabled (Reported by Joshua Colp) Improvements made in this release: ----------------------------------- * ASTERISK-24718 - [patch]Add inital support of "sanitize" to configure (Reported by Badalian Vyacheslav) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.21.0 Thank you for your continued support of Asterisk!
2015-11-25add information about the version, requested by gdt@jnemeth1-0/+5
2015-11-03Add SHA512 digests for distfiles for comms categoryagc1-1/+3
Existing SHA1 digests verified, all found to be the same on the machine holding the existing distfiles (morden). Existing SHA1 digests retained for now as an audit trail.
2015-11-02extraneous parenthesis crept in in Darwin conditionaltnn1-2/+2
2015-11-02appease pkglinttnn1-8/+8
2015-11-02Use ${COMPILER_INCLUDE_DIRS} instead of hardcoded /usr/includetnn1-7/+17
2015-10-27Update Asterisk to 11.20.0: this is mainly a bug fix release.jnemeth24-60/+850
pkgsrc changes: - from joerg@ - srtp support - new asterisk-config option to control installing of sample config files - manifest.xml for Solaris' SMF - various bugfixes, some reworked by myself - backport kqueue timer update from Asterisk 13 ----- The Asterisk Development Team has announced the release of Asterisk 11.20.0. The release of Asterisk 11.20.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-25449 - main/sched: Regression introduced by 5c713fdf18f causes erroneous duplicate RTCP messages; other potential scheduling issues in chan_sip/chan_skinny (Reported by Matt Jordan) * ASTERISK-25438 - res_rtp_asterisk: ICE role message even when ICE is not enabled (Reported by Joshua Colp) * ASTERISK-25427 - Callerid change does not always emit NewCallerid AMI event (Reported by Ivan Poddubny) * ASTERISK-25407 - Asterisk fails to log to multiple syslog destinations (Reported by Elazar Broad) * ASTERISK-25410 - app_record: RECORDED_FILE variable not being populated (Reported by Kevin Harwell) * ASTERISK-25394 - pbx: Incorrect device and presence state when changing hint details (Reported by Joshua Colp) * ASTERISK-25396 - chan_sip: Extremely long callerid name causes invalid SIP (Reported by Walter Doekes) * ASTERISK-25353 - [patch] Transcoding while different in Frame size = Frames lost (Reported by Alexander Traud) * ASTERISK-25227 - No audio at in-band announcements in ooh323 channel (Reported by Alexandr Dranchuk) * ASTERISK-25346 - chan_sip: Overwriting answered elsewhere hangup cause on call pickup (Reported by Joshua Colp) * ASTERISK-25215 - Differences in queue.log between Set QUEUE_MEMBER and using PauseQueueMember (Reported by Lorne Gaetz) * ASTERISK-25320 - chan_sip.c: sip_report_security_event searches for wrong or non existent peer on invite (Reported by Kevin Harwell) * ASTERISK-25315 - DAHDI channels send shortened duration DTMF tones. (Reported by Richard Mudgett) * ASTERISK-25312 - res_http_websocket: Terminate connection on fatal cases (Reported by Joshua Colp) * ASTERISK-25265 - [patch]DTLS Failure when calling WebRTC-peer on Firefox 39 - add ECDH support and fallback to prime256v1 (Reported by Stefan Engström) Improvements made in this release: ----------------------------------- * ASTERISK-25310 - [patch]on FreeBSD also pthread_attr_init() defaults to PTHREAD_EXPLICIT_SCHED (Reported by Guido Falsi) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.20.0 Thank you for your continued support of Asterisk!
2015-10-10Recursive revbump from textproc/icuryoon1-2/+2
2015-08-18Bump all packages that depend on curses.bui* or terminfo.bui* since theywiz1-1/+2
might incur ncurses dependencies on some platforms, and ncurses just bumped its shlib. Some packages were bumped twice now, sorry for that.
2015-08-09quickly eliminate PKGREVISION on updatejnemeth1-2/+1
2015-08-09Update to Asterisk 11.19.0: this is mainly a bug fix release withjnemeth8-83/+161
minor features pkgsrc changes: - new version of core sounds - add options for SNMP and PostgreSQL from Mike Bowie in PR/49661 and by popular demand - add back support for menuselect personalization as that's how I was doing menuselect non-interactively - XXX need to look at a better way of doing this - disable PJSIP for now as it doesn't work well on NetBSD from Mike Bowie Since I added an option for PostgreSQL I also looked at adding an option for directly using MySQL. Turns out that all the MySQL modules are in the addons directory and are marked as being deprecated. So I didn't bother. While investigating this, I also noted that all the pgsql modules are marked as "extended" support. This basically means that it is supported by the community, but there is no one person listed as being responsible who would take the lead for maintaining them. This basically means that they are unsupported / low priority. See https://wiki.asterisk.org/wiki/display/AST/Asterisk+Module+Support+States . Also with the pgsql modules, there is no way to do a database query from the dialplan. Thus it is recommended to use the unixodbc option as the modules are supported and offer the most functionality. ----- The Asterisk Development Team has announced the release of Asterisk 11.19.0. The release of Asterisk 11.19.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-25250 - chan_sip - Despite the channel being answered, caller on a call established via Local channel continues to hear ringback (Reported by Etienne Lessard) * ASTERISK-25247 - choppy audio when spying on a g722 channel, chan_sip or chan_pjsip (Reported by hristo) * ASTERISK-24853 - Documentation claims chan_sip outbound registrations support WS or WSS as valid transports (not true) (Reported by PSDK) * ASTERISK-25257 - [patch]channels/sig_pri.h -> sig_pri_span -> force_restart_unavailable_chans in wrong scope (Reported by Patric Marschall) * ASTERISK-25103 - Roundup - investigate Asterisk DTLS crashes (Reported by Rusty Newton) * ASTERISK-22805 - res_rtp_asterisk: Crash when calling BIO_ctrl_pending in dtls_srtp_check_pending when dialed by JSSIP (Reported by Dmitry Burilov) * ASTERISK-24550 - res_rtp_asterisk: Crash in ast_rtp_on_ice_complete during DTLS handshake (Reported by Osaulenko Alexander) * ASTERISK-24651 - [patch] Fix race condition in DTLS (Reported by Badalian Vyacheslav) * ASTERISK-24832 - [patch]DTLS-crashes within openssl (Reported by Stefan Engström) * ASTERISK-25127 - DTLS crashes following "Unable to cancel schedule ID" in dtls_srtp_check_pending (Reported by Dade Brandon) * ASTERISK-25213 - [patch]Possibility of deadlock in chan_sip INVITE early Replace code (Reported by Walter Doekes) * ASTERISK-25220 - [patch]Closing of fd -1 in chan_mgcp.c (Reported by Walter Doekes) * ASTERISK-25219 - [patch]Source and destination overlap in memcpy in rtp_engine.c (Reported by Walter Doekes) * ASTERISK-25212 - [patch]Segfault when using DEBUG_FD_LEAKS (Reported by Walter Doekes) * ASTERISK-19277 - [patch]endlessly repeating error: "poll failed: Bad file descriptor" (Reported by Barry Chern) * ASTERISK-25202 - Hints extension state broken between 13.3.2 and 13.4 (Reported by cervajs) * ASTERISK-25154 - [patch]fromtag may need to be updated after successful call dialog match (Reported by Damian Ivereigh) * ASTERISK-25139 - Malicious transfer sequence locks up Asterisk (Reported by Gregory Massel) * ASTERISK-25094 - PBX core: Investigate thread safety issues (Reported by Corey Farrell) * ASTERISK-22559 - gcc 4.6 and higher supports weakref attribute but asterisk doesn't detect it. (Reported by ibercom) * ASTERISK-24717 - ASAN: global-buffer-overflow codec_{ilbc | gsm | adpcm | ipc10} (Reported by Badalian Vyacheslav) * ASTERISK-25100 - asterisk coredump if host has an IPv6 address that end with ::80 (Reported by Mark Petersen) Improvements made in this release: ----------------------------------- * ASTERISK-25040 - pbx: Improve performance of reloads by making hint destruction more performant (Reported by Matt Jordan) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.19.0 Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.18.0. The release of Asterisk 11.18.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-25112 - Logger: Configuration settings are not reset to default during reload. (Reported by Corey Farrell) * ASTERISK-24887 - [patch]tags in a=crypto lines do not accept 2 or more digits (Reported by Makoto Dei) * ASTERISK-24944 - main/audiohook.c change prevents G722 call recording (Reported by Ronald Raikes) * ASTERISK-25083 - Message.c: Message channel becomes saturated with frames leading to spammy log messages (Reported by Jonathan Rose) * ASTERISK-25041 - [patch]Broken column type checking in res_config_mysql addon (Reported by Alexandre Fournier) * ASTERISK-21893 - Segfault after call hangup, in ast_channel_hangupcause_set, at channel_internal_api.c (Reported by Alexandr Gordeev) * ASTERISK-25074 - Regression: Recent clang-related change broke cross compiling of Asterisk (Reported by Sebastian Kemper) * ASTERISK-25042 - asterisk.conf options override command-line options. (Reported by Corey Farrell) * ASTERISK-24442 - Outgoing call files don't work properly when set in the future (Reported by tootai) * ASTERISK-25034 - chan_dahdi: Some telco switches occasionally ignore ISDN RESTART requests. (Reported by Richard Mudgett) * ASTERISK-25038 - Queue log "EXITWITHTIMEOUT" does not always contain waiting time (Reported by Etienne Lessard) * ASTERISK-22708 - res_odbc.conf negative_connection_cache option not respected, failover between DSNs doesn't work (Reported by JoshE) * ASTERISK-25028 - Build System: Unneeded defines in asterisk/buildopts.h (Reported by Corey Farrell) * ASTERISK-19608 - Asterisk-1.8.x starts rejecting calls with cause code 44 after some time. (Reported by Denis Alberto Martinez) * ASTERISK-24976 - cdr_odbc not include new columns added on 1.8 (Reported by Rodrigo Ramirez Norambuena) * ASTERISK-25022 - Memory leak setting up DTLS/SRTP calls (Reported by Steve Davies) * ASTERISK-22790 - check_modem_rate() may return incorrect rate for V.27 (Reported by not here) * ASTERISK-23231 - Since 405693 If we have res_fax.conf file set to minrate=2400, then res_fax refuse to load (Reported by David Brillert) * ASTERISK-24955 - res_fax: v.27ter support baud rate of 2400, which is disallowed in res_fax's check_modem_rate (Reported by Matt Jordan) * ASTERISK-24916 - Increasing memory usage when multiple reinvite during call (Reported by Christophe Osuna) * ASTERISK-19538 - Asterisk segfaults on sippeers realtime redundancy (Reported by Alex) * ASTERISK-24749 - ConfBridge: Wrong language on playing conf-hasjoin and conf-hasleft when played to bridge (Reported by Philippe Bolduc) * ASTERISK-24991 - Check for ao2_alloc failure in __ast_channel_internal_alloc (Reported by Corey Farrell) * ASTERISK-24895 - After hangup on the side of the ISDN network no HangupRequest event comes for the dahdi channel. (Reported by Andrew Zherdin) * ASTERISK-24774 - Segfault in ast_context_destroy with extensions.ael and extensions.conf (Reported by Corey Farrell) * ASTERISK-24975 - Enabling 'DEBUG_THREADLOCALS' Causes the Build to Fail (Reported by Ashley Sanders) * ASTERISK-24959 - [patch]CLI command cdr show pgsql status (Reported by Rodrigo Ramirez Norambuena) * ASTERISK-24954 - Git migration: Asterisk version numbers are incompatible with the Test Suite (Reported by Matt Jordan) * ASTERISK-21777 - Asterisk tries to transcode video instead of audio (Reported by Nick Ruggles) * ASTERISK-24380 - core: Native formats are set to h264 with certain audio/video codec configuration, resulting in path translation WARNINGs (Reported by Matt Jordan) * ASTERISK-22352 - [patch] IAX2 custom qualify timer is not taken into account (Reported by Frederic Van Espen) * ASTERISK-24894 - [patch] iax2_poke_noanswer expiration timer too short (Reported by Y Ateya) * ASTERISK-23319 - Segmentation fault in queue_exec at app_queue.c (Reported by Vadim) * ASTERISK-24847 - [security] [patch] tcptls: certificate CN NULL byte prefix bug (Reported by Matt Jordan) * ASTERISK-21211 - chan_iax2 - unprotected access of iaxs[peer->callno] potentially results in segfault (Reported by Jaco Kroon) * ASTERISK-18032 - [patch] - IPv6 and IPv4 NAT not working (Reported by Christoph Timm) * ASTERISK-24942 - Voicemail API: message is deleted when destination mailbox is at maxmsg (Reported by Scott Griepentrog) * ASTERISK-24932 - Asterisk 13.x does not build with GCC 5.0 (Reported by Jeffrey C. Ollie) * ASTERISK-21854 - Long Asterisk-version strings display improperly in the 'Connected to ...' line upon remote console connection (Reported by klaus3000) * ASTERISK-24155 - [patch]Non-portable and non-reliable recursion detection in ast_malloc (Reported by Timo Teräs) * ASTERISK-24142 - CCSS: crash during shutdown due to device lookup in destroyed container (Reported by David Brillert) * ASTERISK-24683 - Crash in PBX ast_hashtab_lookup_internal during core restart now (Reported by Peter Katzmann) * ASTERISK-24805 - [patch] - ASAN: Race condition (heap-use-after-free) on asterisk closing (Reported by Badalian Vyacheslav) * ASTERISK-24881 - ast_register_atexit should only be used when absolutely needed (Reported by Corey Farrell) * ASTERISK-24864 - app_confbridge: file playback blocks dtmf (Reported by Kevin Harwell) * ASTERISK-14233 - [patch] Buddies are always auto-registered when processing the roster (Reported by Simon Arlott) * ASTERISK-24780 - [patch] - Buddies are always auto-registered when processing the roster (Reported by Simon Arlott) Improvements made in this release: ----------------------------------- * ASTERISK-24744 - Swedish Core Voice prompts (Reported by Tove Hjelm) * ASTERISK-25043 - [patch] Avoiding ERR_remove_state in OpenSSL (Reported by Alexander Traud) * ASTERISK-24917 - [patch] clang compilation warnings (Reported by Diederik de Groot) * ASTERISK-25040 - pbx: Improve performance of reloads by making hint destruction more performant (Reported by Matt Jordan) * ASTERISK-24965 - cel_pgsql - log_error string references CDR instead of CEL (Reported by Rodrigo Ramirez Norambuena) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.18.0 Thank you for your continued support of Asterisk!
2015-06-12Recursive PKGREVISION bump for all packages mentioning 'perl',wiz1-1/+2
having a PKGNAME of p5-*, or depending such a package, for perl-5.22.0.
2015-05-19Update to Asterisk 11.17.1: this contains a security fix, plus various bugs.jnemeth34-161/+792
pkgsrc changes: - adapt to upstream support for clang - more comprehensive sweep for 64-bit time_t related stuff - XXX pjsip has its own time related stuff that is 32-bit only ----- The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.28, 11.6, and 13.1 and Asterisk 1.8, 11, 12, and 13. The available security releases are released as versions 1.8.28.cert-5, 1.8.32.3, 11.6-cert11, 11.17.1, 12.8.2, 13.1-cert2, and 13.3.2. The release of these versions resolves the following security vulnerability: * AST-2015-003: TLS Certificate Common name NULL byte exploit When Asterisk registers to a SIP TLS device and and verifies the server, Asterisk will accept signed certificates that match a common name other than the one Asterisk is expecting if the signed certificate has a common name containing a null byte after the portion of the common name that Asterisk expected. This potentially allows for a man in the middle attack. For more information about the details of this vulnerability, please read security advisory AST-2015-003, which was released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.17.1 The security advisory is available at: * http://downloads.asterisk.org/pub/security/AST-2015-003.pdf Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.17.0. The release of Asterisk 11.17.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: New Features made in this release: ----------------------------------- * ASTERISK-17899 - Handle crypto lifetime in SDES-SRTP negotiation (Reported by Dwayne Hubbard) Bugs fixed in this release: ----------------------------------- * ASTERISK-24742 - [patch] Fix ast_odbc_find_table function in res_odbc (Reported by ibercom) * ASTERISK-22436 - [patch] No BYE to masqueraded channel on INVITE with replaces (Reported by Eelco Brolman) * ASTERISK-24479 - Enable REF_DEBUG for module references (Reported by Corey Farrell) * ASTERISK-24701 - Stasis: Write timeout on WebSocket fails to fully disconnect underlying socket, leading to events being dropped with no additional information (Reported by Matt Jordan) * ASTERISK-24772 - ODBC error in realtime sippeers when device unregisters under MariaDB (Reported by Richard Miller) * ASTERISK-24451 - chan_iax2: reference leak in sched_delay_remove (Reported by Corey Farrell) * ASTERISK-24799 - [patch] make fails with undefined reference to SSLv3_client_method (Reported by Alexander Traud) * ASTERISK-24787 - [patch] - Microsoft exchange incompatibility for playing back messages stored in IMAP - play_message: No origtime (Reported by Graham Barnett) * ASTERISK-24814 - asterisk/lock.h: Fix syntax errors for non-gcc OSX with 64 bit integers (Reported by Corey Farrell) * ASTERISK-24796 - Codecs and bucket schema's prevent module unload (Reported by Corey Farrell) * ASTERISK-24724 - 'httpstatus' Web Page Produces Incomplete HTML (Reported by Ashley Sanders) * ASTERISK-24797 - bridge_softmix: G.729 codec license held (Reported by Kevin Harwell) * ASTERISK-24800 - Crash in __sip_reliable_xmit due to invalid thread ID being passed to pthread_kill (Reported by JoshE) * ASTERISK-17721 - Incoming SRTP calls that specify a key lifetime fail (Reported by Terry Wilson) * ASTERISK-23214 - chan_sip WARNING message 'We are requesting SRTP for audio, but they responded without it' is ambiguous and wrong in some cases (Reported by Rusty Newton) * ASTERISK-15434 - [patch] When ast_pbx_start failed, both an error response and BYE are sent to the caller (Reported by Makoto Dei) * ASTERISK-18105 - most of asterisk modules are unbuildable in cygwin environment (Reported by feyfre) * ASTERISK-24828 - Fix Frame Leaks (Reported by Kevin Harwell) * ASTERISK-24838 - chan_sip: Locking inversion occurs when building a peer causes a peer poke during request handling (Reported by Richard Mudgett) * ASTERISK-24825 - Caller ID not recognized using Centrex/Distinctive dialing (Reported by Richard Mudgett) * ASTERISK-24739 - [patch] - Out of files -- call fails -- numerous files with inodes from under /usr/share/zoneinfo, mostly posixrules (Reported by Ed Hynan) * ASTERISK-23390 - NewExten Event with application AGI shows up before and after AGI runs (Reported by Benjamin Keith Ford) * ASTERISK-24786 - [patch] - Asterisk terminates when playing a voicemail stored in LDAP (Reported by Graham Barnett) * ASTERISK-24808 - res_config_odbc: Improper escaping of backslashes occurs with MySQL (Reported by Javier Acosta) * ASTERISK-20850 - [patch]Nested functions aren't portable. Adapting RAII_VAR to use clang/llvm blocks to get the same/similar functionality. (Reported by Diederik de Groot) * ASTERISK-19470 - Documentation on app_amd is incorrect (Reported by Frank DiGennaro) * ASTERISK-21038 - Bad command completion of "core set debug channel" (Reported by Richard Kenner) * ASTERISK-18708 - func_curl hangs channel under load (Reported by Dave Cabot) * ASTERISK-16779 - Cannot disallow unknown format '' (Reported by Atis Lezdins) * ASTERISK-24876 - Investigate reference leaks from tests/channels/local/local_optimize_away (Reported by Corey Farrell) * ASTERISK-24817 - init_logger_chain: unreachable code block (Reported by Corey Farrell) * ASTERISK-24880 - [patch]Compilation under OpenBSD (Reported by snuffy) * ASTERISK-24879 - [patch]Compilation fails due to 64bit time under OpenBSD (Reported by snuffy) Improvements made in this release: ----------------------------------- * ASTERISK-24790 - Reduce spurious noise in logs from voicemail - Couldn't find mailbox %s in context (Reported by Graham Barnett) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.17.0 Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.16.0. The release of Asterisk 11.16.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-24472 - Asterisk Crash in OpenSSL when calling over WSS from JSSIP (Reported by Badalian Vyacheslav) * ASTERISK-24614 - Deadlock when DEBUG_THREADS compiler flag enabled (Reported by Richard Mudgett) * ASTERISK-24449 - Reinvite for T.38 UDPTL fails if SRTP is enabled (Reported by Andreas Steinmetz) * ASTERISK-24619 - [patch]Gcc 4.10 fixes in r413589 (1.8) wrongly casts char to unsigned int (Reported by Walter Doekes) * ASTERISK-24337 - Spammy DEBUG message needs to be at a higher level - 'Remote address is null, most likely RTP has been stopped' (Reported by Rusty Newton) * ASTERISK-23733 - 'reload acl' fails if acl.conf is not present on startup (Reported by Richard Kenner) * ASTERISK-24628 - [patch] chan_sip - CANCEL is sent to wrong destination when 'sendrpid=yes' (in proxy environment) (Reported by Karsten Wemheuer) * ASTERISK-24672 - [PATCH] Memory leak in func_curl CURLOPT (Reported by Kristian Høgh) * ASTERISK-20744 - [patch] Security event logging does not work over syslog (Reported by Michael Keuter) * ASTERISK-23850 - Park Application does not respect Return Context Priority (Reported by Andrew Nagy) * ASTERISK-23991 - [patch]asterisk.pc file contains a small error in the CFlags returned (Reported by Diederik de Groot) * ASTERISK-24288 - [patch] - ODBC usage with app_voicemail - voicemail is not deleted after review, hangup (Reported by LEI FU) * ASTERISK-24048 - [patch] contrib/scripts/install_prereq selects 32-bit packages on 64-bit hosts (Reported by Ben Klang) * ASTERISK-24709 - [patch] msg_create_from_file used by MixMonitor m() option does not queue an MWI event (Reported by Gareth Palmer) * ASTERISK-24355 - [patch] chan_sip realtime uses case sensitive column comparison for 'defaultuser' (Reported by HZMI8gkCvPpom0tM) * ASTERISK-24719 - ConfBridge recording channels get stuck when recording started/stopped more than once (Reported by Richard Mudgett) * ASTERISK-24715 - chan_sip: stale nonce causes failure (Reported by Kevin Harwell) * ASTERISK-24728 - tcptls: Bad file descriptor error when reloading chan_sip (Reported by Kevin Harwell) * ASTERISK-24676 - Security Vulnerability: URL request injection in libCURL (CVE-2014-8150) (Reported by Matt Jordan) * ASTERISK-24711 - DTLS handshake broken with latest OpenSSL versions (Reported by Jared Biel) * ASTERISK-24646 - PJSIP changeset 4899 breaks TLS (Reported by Stephan Eisvogel) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.16.0 Thank you for your continued support of Asterisk!
2015-04-26Recursive revbump from databases/unixodbc.ryoon1-2/+2
2015-04-25Recursive revbump following MesaLib update, categories a through f.tnn1-2/+2
2015-04-06Revbump after updating textproc/icuadam1-1/+2
2015-03-15NOT_FOR_PLATFORM->BROKEN_ON_PLATFORM as requested by dholland@jnemeth1-2/+2
2015-01-29Update to Asterisk 11.15.1: this is a security fix.jnemeth3-10/+11
pkgsrc change: adapt to splitting up of speex The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available security releases are released as versions 1.8.28.cert-4, 1.8.32.2, 11.6-cert10, 11.15.1, 12.8.1, and 13.1.1. The release of these versions resolves the following security vulnerabilities: * AST-2015-001: File descriptor leak when incompatible codecs are offered Asterisk may be configured to only allow specific audio or video codecs to be used when communicating with a particular endpoint. When an endpoint sends an SDP offer that only lists codecs not allowed by Asterisk, the offer is rejected. However, in this case, RTP ports that are allocated in the process are not reclaimed. This issue only affects the PJSIP channel driver in Asterisk. Users of the chan_sip channel driver are not affected. * AST-2015-002: Mitigation for libcURL HTTP request injection vulnerability CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules. Since Asterisk may be configured to allow for user-supplied URLs to be passed to libcURL, it is possible that an attacker could use Asterisk as an attack vector to inject unauthorized HTTP requests if the version of libcURL installed on the Asterisk server is affected by CVE-2014-8150. For more information about the details of these vulnerabilities, please read security advisory AST-2015-001 and AST-2015-002, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.32.2 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.15.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2015-001.pdf * http://downloads.asterisk.org/pub/security/AST-2015-002.pdf Thank you for your continued support of Asterisk!
2014-12-16Update to Asterisk 11.15.0: this is mostly a bug fix release.jnemeth3-17/+17
The Asterisk Development Team has announced the release of Asterisk 11.15.0. The release of Asterisk 11.15.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-20127 - [Regression] Config.c config_text_file_load() unescapes semicolons ("\;" -> ";") turning them into comments (corruption) on rewrite of a config file (Reported by George Joseph) * ASTERISK-24307 - Unintentional memory retention in stringfields (Reported by Etienne Lessard) * ASTERISK-24492 - main/file.c: ast_filestream sometimes causes extra calls to ast_module_unref (Reported by Corey Farrell) * ASTERISK-24504 - chan_console: Fix reference leaks to pvt (Reported by Corey Farrell) * ASTERISK-24468 - Incoming UCS2 encoded SMS truncated if SMS length exceeds 50 (roughly) national symbols (Reported by Dmitriy Bubnov) * ASTERISK-24500 - Regression introduced in chan_mgcp by SVN revision r227276 (Reported by Xavier Hienne) * ASTERISK-20402 - Unable to cancel (features.conf) attended transfer (Reported by Matt Riddell) * ASTERISK-24505 - manager: http connections leak references (Reported by Corey Farrell) * ASTERISK-24502 - Build fails when dev-mode, dont optimize and coverage are enabled (Reported by Corey Farrell) * ASTERISK-24444 - PBX: Crash when generating extension for pattern matching hint (Reported by Leandro Dardini) * ASTERISK-24522 - ConfBridge: delay occurs between kicking all endmarked users when last marked user leaves (Reported by Matt Jordan) * ASTERISK-15242 - transmit_refer leaks sip_refer structures (Reported by David Woolley) * ASTERISK-24440 - Call leak in Confbridge (Reported by Ben Klang) * ASTERISK-24469 - Security Vulnerability: Mixed IPv4/IPv6 ACLs allow blocked addresses through (Reported by Matt Jordan) * ASTERISK-24516 - [patch]Asterisk segfaults when playing back voicemail under high concurrency with an IMAP backend (Reported by David Duncan Ross Palmer) * ASTERISK-24572 - [patch]App_meetme is loaded without its defaults when the configuration file is missing (Reported by Nuno Borges) * ASTERISK-24573 - [patch]Out of sync conversation recording when divided in multiple recordings (Reported by Nuno Borges) Improvements made in this release: ----------------------------------- * ASTERISK-24283 - [patch]Microseconds precision in the eventtime column in the cel_odbc module (Reported by Etienne Lessard) * ASTERISK-24530 - [patch] app_record stripping 1/4 second from recordings (Reported by Ben Smithurst) * ASTERISK-24577 - Speed up loopback switches by avoiding unneeded lookups (Reported by Birger "WIMPy" Harzenetter) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.15.0 Thank you for your continued support of Asterisk!
2014-12-12Update to Asterisk 11.14.2: this is a security fix release.jnemeth2-9/+9
The Asterisk Development Team has announced security releases for Certified Asterisk 11.6 and Asterisk 11, 12, and 13. The available security releases are released as versions 11.6-cert9, 11.14.2, 12.7.2, and 13.0.2. The release of these versions resolves the following security vulnerability: * AST-2014-019: Remote Crash Vulnerability in WebSocket Server When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure. When the session was subsequently torn down this memory would get freed yet again causing a crash. For more information about the details of this vulnerability, please read security advisory AST-2014-019, which was released at the same time as this announcement. For a full list of changes in the current releases, please see the Change Logs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.14.2 The security advisory is available at: * http://downloads.asterisk.org/pub/security/AST-2014-019.pdf Thank you for your continued support of Asterisk!
2014-12-03Update to Asterisk 11.14.1: this is a security fix release.jnemeth2-9/+9
The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available security releases are released as versions 1.8.28-cert3, 11.6-cert8, 1.8.32.1, 11.14.1, 12.7.1, and 13.0.1. The release of these versions resolves the following security vulnerabilities: * AST-2014-012: Unauthorized access in the presence of ACLs with mixed IP address families Many modules in Asterisk that service incoming IP traffic have ACL options ("permit" and "deny") that can be used to whitelist or blacklist address ranges. A bug has been discovered where the address family of incoming packets is only compared to the IP address family of the first entry in the list of access control rules. If the source IP address for an incoming packet is not of the same address as the first ACL entry, that packet bypasses all ACL rules. * AST-2014-018: Permission Escalation through DB dialplan function The DB dialplan function when executed from an external protocol, such as AMI, could result in a privilege escalation. Users with a lower class authorization in AMI can access the internal Asterisk database without the required SYSTEM class authorization. In addition, the release of 11.6-cert8 and 11.14.1 resolves the following security vulnerability: * AST-2014-014: High call load with ConfBridge can result in resource exhaustion The ConfBridge application uses an internal bridging API to implement conference bridges. This internal API uses a state model for channels within the conference bridge and transitions between states as different things occur. Unload load it is possible for some state transitions to be delayed causing the channel to transition from being hung up to waiting for media. As the channel has been hung up remotely no further media will arrive and the channel will stay within ConfBridge indefinitely. In addition, the release of 11.6-cert8, 11.14.1, 12.7.1, and 13.0.1 resolves the following security vulnerability: * AST-2014-017: Permission Escalation via ConfBridge dialplan function and AMI ConfbridgeStartRecord Action The CONFBRIDGE dialplan function when executed from an external protocol (such as AMI) can result in a privilege escalation as certain options within that function can affect the underlying system. Additionally, the AMI ConfbridgeStartRecord action has options that would allow modification of the underlying system, and does not require SYSTEM class authorization in AMI. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.14.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2014-012.pdf * http://downloads.asterisk.org/pub/security/AST-2014-014.pdf * http://downloads.asterisk.org/pub/security/AST-2014-017.pdf * http://downloads.asterisk.org/pub/security/AST-2014-018.pdf Thank you for your continued support of Asterisk!
2014-11-19Update to Asterisk 11.14.0: this is mostly a bugfix release.jnemeth3-32/+9
The Asterisk Development Team has announced the release of Asterisk 11.14.0. The release of Asterisk 11.14.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-24348 - Built-in editline tab complete segfault with MALLOC_DEBUG (Reported by Walter Doekes) * ASTERISK-24335 - [PATCH] Asterisk incorrectly responds 503 to INVITE retransmissions of rejected calls (Reported by Torrey Searle) * ASTERISK-23768 - [patch] Asterisk man page contains a (new) unquoted minus sign (Reported by Jeremy Lainé) * ASTERISK-24357 - [fax] Out of bounds error in update_modem_bits (Reported by Jeremy Lainé) * ASTERISK-20567 - bashism in autosupport (Reported by Tzafrir Cohen) * ASTERISK-22945 - [patch] Memory leaks in chan_sip.c with realtime peers (Reported by ibercom) * ASTERISK-24384 - chan_motif: format capabilities leak on module load error (Reported by Corey Farrell) * ASTERISK-24385 - chan_sip: process_sdp leaks on an error path (Reported by Corey Farrell) * ASTERISK-24378 - Release AMI connections on shutdown (Reported by Corey Farrell) * ASTERISK-24354 - AMI sendMessage closes AMI connection on error (Reported by Peter Katzmann) * ASTERISK-24390 - astobj2: REF_DEBUG reports false leaks with ao2_callback with OBJ_MULTIPLE (Reported by Corey Farrell) * ASTERISK-24326 - res_rtp_asterisk: ICE-TCP candidates are incorrectly attempted (Reported by Joshua Colp) * ASTERISK-24011 - [patch]safe_asterisk tries to set ulimit -n too high on linux systems with lots of RAM (Reported by Michael Myles) * ASTERISK-24383 - res_rtp_asterisk: Crash if no candidates received for component (Reported by Kevin Harwell) * ASTERISK-20784 - Failure to receive an ACK to a SIP Re-INVITE results in a SIP channel leak (Reported by NITESH BANSAL) * ASTERISK-15879 - [patch] Failure to receive an ACK to a SIP Re-INVITE results in a SIP channel leak (Reported by Torrey Searle) * ASTERISK-24406 - Some caller ID strings are parsed differently since 11.13.0 (Reported by Etienne Lessard) * ASTERISK-24325 - res_calendar_ews: cannot be used with neon 0.30 (Reported by Tzafrir Cohen) * ASTERISK-13797 - [patch] relax badshell tilde test (Reported by Tzafrir Cohen) * ASTERISK-22791 - asterisk sends Re-INVITE after receiving a BYE (Reported by Paolo Compagnini) * ASTERISK-18923 - res_fax_spandsp usage counter is wrong (Reported by Grigoriy Puzankin) * ASTERISK-24392 - res_fax: fax gateway sessions leak (Reported by Corey Farrell) * ASTERISK-24393 - rtptimeout=0 doesn't disable rtptimeout (Reported by Dmitry Melekhov) * ASTERISK-23846 - Unistim multilines. Loss of voice after second call drops (on a second line). (Reported by Rustam Khankishyiev) * ASTERISK-24063 - [patch]Asterisk does not respect outbound proxy when sending qualify requests (Reported by Damian Ivereigh) * ASTERISK-24425 - [patch] jabber/xmpp to use TLS instead of SSLv3, security fix POODLE (CVE-2014-3566) (Reported by abelbeck) * ASTERISK-24436 - Missing header in res/res_srtp.c when compiling against libsrtp-1.5.0 (Reported by Patrick Laimbock) * ASTERISK-24454 - app_queue: ao2_iterator not destroyed, causing leak (Reported by Corey Farrell) * ASTERISK-24430 - missing letter "p" in word response in OriginateResponse event documentation (Reported by Dafi Ni) * ASTERISK-24457 - res_fax: fax gateway frames leak (Reported by Corey Farrell) * ASTERISK-21721 - SIP Failed to parse multiple Supported: headers (Reported by Olle Johansson) * ASTERISK-24304 - asterisk crashing randomly because of unistim channel (Reported by dhanapathy sathya) * ASTERISK-24190 - IMAP voicemail causes segfault (Reported by Nick Adams) * ASTERISK-24466 - app_queue: fix a couple leaks to struct call_queue (Reported by Corey Farrell) * ASTERISK-24432 - Install refcounter.py when REF_DEBUG is enabled (Reported by Corey Farrell) * ASTERISK-24476 - main/app.c / app_voicemail: ast_writestream leaks (Reported by Corey Farrell) * ASTERISK-24307 - Unintentional memory retention in stringfields (Reported by Etienne Lessard) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.14.0 Thank you for your continued support of Asterisk!
2014-10-14Update Asterisk to 11.13.0. This is mostly a bugfix release:jnemeth3-21/+20
The Asterisk Development Team has announced the release of Asterisk 11.13.0. The release of Asterisk 11.13.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-24032 - Gentoo compilation emits warning: "_FORTIFY_SOURCE" redefined (Reported by Kilburn) * ASTERISK-24225 - Dial option z is broken (Reported by dimitripietro) * ASTERISK-24178 - [patch]fromdomainport used even if not set (Reported by Elazar Broad) * ASTERISK-22252 - res_musiconhold cleanup - REF_DEBUG reload warnings and ref leaks (Reported by Walter Doekes) * ASTERISK-23997 - chan_sip: port incorrectly incremented for RTCP ICE candidates in SDP answer (Reported by Badalian Vyacheslav) * ASTERISK-24019 - When a Music On Hold stream starts it restarts at beginning of file. (Reported by Jason Richards) * ASTERISK-23767 - [patch] Dynamic IAX2 registration stops trying if ever not able to resolve (Reported by David Herselman) * ASTERISK-24211 - testsuite: Fix the dial_LS_options test (Reported by Matt Jordan) * ASTERISK-24249 - SIP debugs do not stop (Reported by Avinash Mohod) * ASTERISK-23577 - res_rtp_asterisk: Crash in ast_rtp_on_turn_rtp_state when RTP instance is NULL (Reported by Jay Jideliov) * ASTERISK-23634 - With TURN Asterisk crashes on multiple (7-10) concurrent WebRTC (avpg/encryption/icesupport) calls (Reported by Roman Skvirsky) * ASTERISK-24301 - Security: Out of call MESSAGE requests processed via Message channel driver can crash Asterisk (Reported by Matt Jordan) Improvements made in this release: ----------------------------------- * ASTERISK-24171 - [patch] Provide a manpage for the aelparse utility (Reported by Jeremy Lainé) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.13.0 Thank you for your continued support of Asterisk!
2014-10-07Revbump after updating libwebp and icuadam1-1/+2
2014-09-20Update to Asterisk 11.12.1: this is mainly a security fix for AST-2014-010.jnemeth2-9/+9
The Asterisk Development Team has announced security releases for Certified Asterisk 11.6 and Asterisk 11 and 12. The available security releases are released as versions 11.6-cert6, 11.12.1, and 12.5.1. Please note that the release of these versions resolves the following security vulnerability: * AST-2014-010: Remote Crash when Handling Out of Call Message in Certain Dialplan Configurations Note that the crash described in AST-2014-010 can be worked around through dialplan configuration. Given the likelihood of the issue, an advisory was deemed to be warranted. For more information about the details of these vulnerabilities, please read security advisories AST-2014-009 and AST-2014-010, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.12.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2014-010.pdf Thank you for your continued support of Asterisk!
2014-08-28Update to Asterisk 11.12.0: this is mainly a bugfix release.jnemeth2-9/+9
The Asterisk Development Team has announced the release of Asterisk 11.12.0. The release of Asterisk 11.12.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-23911 - URIENCODE/URIDECODE: WARNING about passing an empty string is a bit over zealous (Reported by Matt Jordan) * ASTERISK-23985 - PresenceState Action response does not contain ActionID; duplicates Message Header (Reported by Matt Jordan) * ASTERISK-23814 - No call started after peer dialed (Reported by Igor Goncharovsky) * ASTERISK-24087 - [patch]chan_sip: sip_subscribe_mwi_destroy should not call sip_destroy (Reported by Corey Farrell) * ASTERISK-23818 - PBX_Lua: after asterisk startup module is loaded, but dialplan not available (Reported by Dennis Guse) * ASTERISK-18345 - [patch] sips connection dropped by asterisk with a large INVITE (Reported by Stephane Chazelas) * ASTERISK-23508 - Memory Corruption in __ast_string_field_ptr_build_va (Reported by Arnd Schmitter) Improvements made in this release: ----------------------------------- * ASTERISK-21178 - Improve documentation for manager command Getvar, Setvar (Reported by Rusty Newton) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.12.0 Thank you for your continued support of Asterisk!
2014-07-29Update to Asterisk 11.11.0: this is primarily a bugfix release.jnemeth4-26/+90
pkgsrc change: MAKE_JOBS_SAFE=NO from joerg@ The Asterisk Development Team has announced the release of Asterisk 11.11.0. The release of Asterisk 11.11.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-22551 - Session timer : UAS (Asterisk) starts counting at Invite, UAC starts counting at 200 OK. (Reported by i2045) * ASTERISK-23792 - Mutex left locked in chan_unistim.c (Reported by Peter Whisker) * ASTERISK-23582 - [patch]Inconsistent column length in *odbc (Reported by Walter Doekes) * ASTERISK-23803 - AMI action UpdateConfig EmptyCat clears all categories but the requested one (Reported by zvision) * ASTERISK-23035 - ConfBridge with name longer than max (32 chars) results in several bridges with same conf_name (Reported by Iñaki Cívico) * ASTERISK-23824 - ConfBridge: Users cannot be muted via CLI or AMI when waiting to enter a conference (Reported by Matt Jordan) * ASTERISK-23683 - #includes - wildcard character in a path more than one directory deep - results in no config parsing on module reload (Reported by tootai) * ASTERISK-23827 - autoservice thread doesn't exit at shutdown (Reported by Corey Farrell) * ASTERISK-23609 - Security: AMI action MixMonitor allows arbitrary programs to be run (Reported by Corey Farrell) * ASTERISK-23673 - Security: DOS by consuming the number of allowed HTTP connections. (Reported by Richard Mudgett) * ASTERISK-23246 - DEBUG messages in sdp_crypto.c display despite a DEBUG level of zero (Reported by Rusty Newton) * ASTERISK-23766 - [patch] Specify timeout for database write in SQLite (Reported by Igor Goncharovsky) * ASTERISK-23844 - Load of pbx_lua fails on sample extensions.lua with Lua 5.2 or greater due to addition of goto statement (Reported by Rusty Newton) * ASTERISK-23818 - PBX_Lua: after asterisk startup module is loaded, but dialplan not available (Reported by Dennis Guse) * ASTERISK-23834 - res_rtp_asterisk debug message gives wrong length if ICE (Reported by Richard Kenner) * ASTERISK-23790 - [patch] - SIP From headers longer than 256 characters result in dropped call and 'No closing bracket' warnings. (Reported by uniken1) * ASTERISK-23917 - res_http_websocket: Delay in client processing large streams of data causes disconnect and stuck socket (Reported by Matt Jordan) * ASTERISK-23908 - [patch]When using FEC error correction, asterisk tries considers negative sequence numbers as missing (Reported by Torrey Searle) * ASTERISK-23921 - refcounter.py uses excessive ram for large refs files (Reported by Corey Farrell) * ASTERISK-23948 - REF_DEBUG fails to record ao2_ref against objects that were already freed (Reported by Corey Farrell) * ASTERISK-23916 - [patch]SIP/SDP fmtp line may include whitespace between attributes (Reported by Alexander Traud) * ASTERISK-23984 - Infinite loop possible in ast_careful_fwrite() (Reported by Steve Davies) * ASTERISK-23897 - [patch]Change in SETUP ACK handling (checking PI) in revision 413765 breaks working environments (Reported by Pavel Troller) Improvements made in this release: ----------------------------------- * ASTERISK-23492 - Add option to safe_asterisk to disable backgrounding (Reported by Walter Doekes) * ASTERISK-22961 - [patch] DTLS-SRTP not working with SHA-256 (Reported by Jay Jideliov) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.11.0 Thank you for your continued support of Asterisk!
2014-07-02Update to Asterisk 11.10.2: this fixes multiple security issues alongjnemeth8-41/+193
with general bug fixes. The security issues fixed are: AST-2014-001, AST-2014-002, AST-2014-006, and AST-2014-007. ----- The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security releases are released as versions 1.8.15-cert7, 11.6-cert4, 1.8.28.2, 11.10.2, and 12.3.2. These releases resolve security vulnerabilities that were previously fixed in 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1. Unfortunately, the fix for AST-2014-007 inadvertently introduced a regression in Asterisk's TCP and TLS handling that prevented Asterisk from sending data over these transports. This regression and the security vulnerabilities have been fixed in the versions specified in this release announcement. Please note that the release of these versions resolves the following security vulnerabilities: * AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized Shell Access * AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP Connections For more information about the details of these vulnerabilities, please read security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008, which were released with the previous versions that addressed these vulnerabilities. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.10.2 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security releases are released as versions 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1. The release of these versions resolves the following issue: * AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP Connections Establishing a TCP or TLS connection to the configured HTTP or HTTPS port respectively in http.conf and then not sending or completing a HTTP request will tie up a HTTP session. By doing this repeatedly until the maximum number of open HTTP sessions is reached, legitimate requests are blocked. Additionally, the release of 11.6-cert3, 11.10.1, and 12.3.1 resolves the following issue: * AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized Shell Access Manager users can execute arbitrary shell commands with the MixMonitor manager action. Asterisk does not require system class authorization for a manager user to use the MixMonitor action, so any manager user who is permitted to use manager commands can potentially execute shell commands as the user executing the Asterisk process. These issues and their resolutions are described in the security advisories. For more information about the details of these vulnerabilities, please read security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.10.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.10.0. The release of Asterisk 11.10.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-23547 - [patch] app_queue removing callers from queue when reloading (Reported by Italo Rossi) * ASTERISK-23559 - app_voicemail fails to load after fix to dialplan functions (Reported by Corey Farrell) * ASTERISK-22846 - testsuite: masquerade super test fails on all branches (still) (Reported by Matt Jordan) * ASTERISK-23545 - Confbridge talker detection settings configuration load bug (Reported by John Knott) * ASTERISK-23546 - CB_ADD_LEN does not do what you'd think (Reported by Walter Doekes) * ASTERISK-23620 - Code path in app_stack fails to unlock list (Reported by Bradley Watkins) * ASTERISK-23616 - Big memory leak in logger.c (Reported by ibercom) * ASTERISK-23576 - Build failure on SmartOS / Illumos / SunOS (Reported by Sebastian Wiedenroth) * ASTERISK-23550 - Newer sound sets don't show up in menuselect (Reported by Rusty Newton) * ASTERISK-18331 - app_sms failure (Reported by David Woodhouse) * ASTERISK-19465 - P-Asserted-Identity Privacy (Reported by Krzysztof Chmielewski) * ASTERISK-23605 - res_http_websocket: Race condition in shutting down websocket causes crash (Reported by Matt Jordan) * ASTERISK-23707 - Realtime Contacts: Apparent mismatch between PGSQL database state and Asterisk state (Reported by Mark Michelson) * ASTERISK-23381 - [patch]ChanSpy- Barge only works on the initial 'spy', if the spied-on channel makes a new call, unable to barge. (Reported by Robert Moss) * ASTERISK-23665 - Wrong mime type for codec H263-1998 (h263+) (Reported by Guillaume Maudoux) * ASTERISK-23664 - Incorrect H264 specification in SDP. (Reported by Guillaume Maudoux) * ASTERISK-22977 - chan_sip+CEL: missing ANSWER and PICKUP event for INVITE/w/replaces pickup (Reported by Walter Doekes) * ASTERISK-23709 - Regression in Dahdi/Analog/waitfordialtone (Reported by Steve Davies) Improvements made in this release: ----------------------------------- * ASTERISK-23649 - [patch]Support for DTLS retransmission (Reported by NITESH BANSAL) * ASTERISK-23564 - [patch]TLS/SRTP status of channel not currently available in a CLI command (Reported by Patrick Laimbock) * ASTERISK-23754 - [patch] Use var/lib directory for log file configured in asterisk.conf (Reported by Igor Goncharovsky) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.10.0 Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.9.0. The release of Asterisk 11.9.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-22790 - check_modem_rate() may return incorrect rate for V.27 (Reported by Paolo Compagnini) * ASTERISK-23034 - [patch] manager Originate doesn't abort on failed format_cap allocation (Reported by Corey Farrell) * ASTERISK-23061 - [Patch] 'textsupport' setting not mentioned in sip.conf.sample (Reported by Eugene) * ASTERISK-23028 - [patch] Asterisk man pages contains unquoted minus signs (Reported by Jeremy Lainé) * ASTERISK-23046 - Custom CDR fields set during a GoSUB called from app_queue are not inserted (Reported by Denis Pantsyrev) * ASTERISK-23027 - [patch] Spelling typo "transfered" instead of "transferred" (Reported by Jeremy Lainé) * ASTERISK-23008 - Local channels loose CALLERID name when DAHDI channel connects (Reported by Michael Cargile) * ASTERISK-23100 - [patch] In chan_mgcp the ident in transmitted request and request queue may differ - fix for locking (Reported by adomjan) * ASTERISK-22988 - [patch]T38 , SIP 488 after Rejecting image media offer due to invalid or unsupported syntax (Reported by adomjan) * ASTERISK-22861 - [patch]Specifying a null time as parameter to GotoIfTime or ExecIfTime causes segmentation fault (Reported by Sebastian Murray-Roberts) * ASTERISK-17837 - extconfig.conf - Maximum Include level (1) exceeded (Reported by pz) * ASTERISK-22662 - Documentation fix? - queues.conf says persistentmembers defaults to yes, it appears to lie (Reported by Rusty Newton) * ASTERISK-23134 - [patch] res_rtp_asterisk port selection cannot handle selinux port restrictions (Reported by Corey Farrell) * ASTERISK-23220 - STACK_PEEK function with no arguments causes crash/core dump (Reported by James Sharp) * ASTERISK-19773 - Asterisk crash on issuing Asterisk-CLI 'reload' command multiple times on cli_aliases (Reported by Joel Vandal) * ASTERISK-22757 - segfault in res_clialiases.so on reload when mapping "module reload" command (Reported by Gareth Blades) * ASTERISK-17727 - [patch] TLS doesn't get all certificate chain (Reported by LN) * ASTERISK-23178 - devicestate.h: device state setting functions are documented with the wrong return values (Reported by Jonathan Rose) * ASTERISK-23232 - LocalBridge AMI Event LocalOptimization value is opposite to what's expected (Reported by Leon Roy) * ASTERISK-23098 - [patch]possible null pointer dereference in format.c (Reported by Marcello Ceschia) * ASTERISK-23297 - Asterisk 12, pbx_config.so segfaults if res_parking.so is not loaded, or if res_parking.conf has no configuration (Reported by CJ Oster) * ASTERISK-23069 - Custom CDR variable not recorded when set in macro called from app_queue (Reported by Bryan Anderson) * ASTERISK-19499 - ConfBridge MOH is not working for transferee after attended transfer (Reported by Timo Teräs) * ASTERISK-23261 - [patch]Output mixup in ${CHANNEL(rtpqos,audio,all)} (Reported by rsw686) * ASTERISK-23279 - [patch]Asterisk doesn't support the dynamic payload change in rtp mapping in the 200 OK response (Reported by NITESH BANSAL) * ASTERISK-23255 - UUID included for Redhat, but missing for Debian distros in install_prereq script (Reported by Rusty Newton) * ASTERISK-23260 - [patch]ForkCDR v option does not keep CDR variables for subsequent records (Reported by zvision) * ASTERISK-23141 - Asterisk crashes on Dial(), in pbx_find_extension at pbx.c (Reported by Maxim) * ASTERISK-23336 - Asterisk warning "Don't know how to indicate condition 33 on ooh323c" on outgoing calls from H323 to SIP peer (Reported by Alexander Semych) * ASTERISK-23231 - Since 405693 If we have res_fax.conf file set to minrate=2400, then res_fax refuse to load (Reported by David Brillert) * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set - probably introduced in 11.7.0 (Reported by OK) * ASTERISK-23323 - [patch]chan_sip: missing p->owner checks in handle_response_invite (Reported by Walter Doekes) * ASTERISK-23406 - [patch]Fix typo in "sip show peer" (Reported by ibercom) * ASTERISK-23310 - bridged channel crashes in bridge_p2p_rtp_write (Reported by Jeremy Lainé) * ASTERISK-22911 - [patch]Asterisk fails to resume WebRTC call from hold (Reported by Vytis Valentinavičius) * ASTERISK-23104 - Specifying the SetVar AMI without a Channel cause Asterisk to crash (Reported by Joel Vandal) * ASTERISK-21930 - [patch]WebRTC over WSS is not working. (Reported by John) * ASTERISK-23383 - Wrong sense test on stat return code causes unchanged config check to break with include files. (Reported by David Woolley) * ASTERISK-20149 - Crash when faxing SIP to SIP with strictrtp set to yes (Reported by Alexandr Gordeev) * ASTERISK-17523 - Qualify for static realtime peers does not work (Reported by Maciej Krajewski) * ASTERISK-21406 - [patch] chan_sip deadlock on monlock between unload_module and do_monitor (Reported by Corey Farrell) * ASTERISK-23373 - [patch]Security: Open FD exhaustion with chan_sip Session-Timers (Reported by Corey Farrell) * ASTERISK-23340 - Security Vulnerability: stack allocation of cookie headers in loop allows for unauthenticated remote denial of service attack (Reported by Matt Jordan) * ASTERISK-23311 - Manager - MoH Stop Event fails to show up when leaving Conference (Reported by Benjamin Keith Ford) * ASTERISK-23420 - [patch]Memory leak in manager_add_filter function in manager.c (Reported by Etienne Lessard) * ASTERISK-23488 - Logic error in callerid checksum processing (Reported by Russ Meyerriecks) * ASTERISK-23461 - Only first user is muted when joining confbridge with 'startmuted=yes' (Reported by Chico Manobela) * ASTERISK-20841 - fromdomain not honored on outbound INVITE request (Reported by Kelly Goedert) * ASTERISK-22079 - Segfault: INTERNAL_OBJ (user_data=0x6374652f) at astobj2.c:120 (Reported by Jamuel Starkey) * ASTERISK-23509 - [patch]SayNumber for Polish language tries to play empty files for numbers divisible by 100 (Reported by zvision) * ASTERISK-23103 - [patch]Crash in ast_format_cmp, in ao2_find (Reported by JoshE) * ASTERISK-23391 - Audit dialplan function usage of channel variable (Reported by Corey Farrell) * ASTERISK-23548 - POST to ARI sometimes returns no body on success (Reported by Scott Griepentrog) * ASTERISK-23460 - ooh323 channel stuck if call is placed directly and gatekeeper is not available (Reported by Dmitry Melekhov) Improvements made in this release: ----------------------------------- * ASTERISK-22980 - [patch]Allow building cdr_radius and cel_radius against libfreeradius-client (Reported by Jeremy Lainé) * ASTERISK-22661 - Unable to exit ChanSpy if spied channel does not have a call in progress (Reported by Chris Hillman) * ASTERISK-23099 - [patch] WSS: enable ast_websocket_read() function to read the whole available data at first and then wait for any fragmented packets (Reported by Thava Iyer) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.9.0 Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security releases are released as versions 1.8.15-cert5, 11.6-cert2, 1.8.26.1, 11.8.1, and 12.1.1. The release of these versions resolve the following issues: * AST-2014-001: Stack overflow in HTTP processing of Cookie headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. Another vulnerability along similar lines is any HTTP request with a ridiculous number of headers in the request could exhaust system memory. * AST-2014-002: chan_sip: Exit early on bad session timers request This change allows chan_sip to avoid creation of the channel and consumption of associated file descriptors altogether if the inbound request is going to be rejected anyway. These issues and their resolutions are described in the security advisories. For more information about the details of these vulnerabilities, please read security advisories AST-2014-001, AST-2014-002, AST-2014-003, and AST-2014-004, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.8.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2014-001.pdf * http://downloads.asterisk.org/pub/security/AST-2014-002.pdf Thank you for your continued support of Asterisk! ----- The Asterisk Development Team has announced the release of Asterisk 11.8.0. The release of Asterisk 11.8.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following are the issues resolved in this release: Bugs fixed in this release: ----------------------------------- * ASTERISK-22544 - Italian prompt vm-options has advertisement in it (Reported by Rusty Newton) * ASTERISK-21383 - STUN Binding Requests Not Being Sent Back from Asterisk to Chrome (Reported by Shaun Clark) * ASTERISK-22478 - [patch]Can't use pound(hash) symbol for custom DTMF menus in ConfBridge (processed as directive) (Reported by Nicolas Tanski) * ASTERISK-12117 - chan_sip creates a new local tag (from-tag) for every register message (Reported by Pawel Pierscionek) * ASTERISK-20862 - Asterisk min and max member penalties not honored when set with 0 (Reported by Schmooze Com) * ASTERISK-22746 - [patch]Crash in chan_dahdi during caller id read (Reported by Michael Walton) * ASTERISK-22788 - [patch] main/translate.c: access to variable f after free in ast_translate() (Reported by Corey Farrell) * ASTERISK-21242 - Segfault when T.38 re-invite retransmission receives 200 OK (Reported by Ashley Winters) * ASTERISK-22590 - BufferOverflow in unpacksms16() when receiving 16 bit multipart SMS with app_sms (Reported by Jan Juergens) * ASTERISK-22905 - Prevent Asterisk functions that are 'dangerous' from being executed from external interfaces (Reported by Matt Jordan) * ASTERISK-23021 - Typos in code : "avaliable" instead of "available" (Reported by Jeremy Lainé) * ASTERISK-22970 - [patch]Documentation fix for QUOTE() (Reported by Gareth Palmer) * ASTERISK-21960 - ooh323 channels stuck (Reported by Dmitry Melekhov) * ASTERISK-22350 - DUNDI - core dump on shutdown - segfault in sqlite3_reset from /usr/lib/libsqlite3.so.0 (Reported by Birger "WIMPy" Harzenetter) * ASTERISK-22942 - [patch] - Asterisk crashed after Set(FAXOPT(faxdetect)=t38) (Reported by adomjan) * ASTERISK-22856 - [patch]SayUnixTime in polish reads minutes instead of seconds (Reported by Robert Mordec) * ASTERISK-22854 - [patch] - Deadlock between cel_pgsql unload and core_event_dispatcher taskprocessor thread (Reported by Etienne Lessard) * ASTERISK-22910 - [patch] - REPLACE() calls strcpy on overlapping memory when <replace-char> is empty (Reported by Gareth Palmer) * ASTERISK-22871 - cel_pgsql module not loading after "reload" or "reload cel_pgsql.so" command (Reported by Matteo) * ASTERISK-23084 - [patch]rasterisk needlessly prints the AST-2013-007 warning (Reported by Tzafrir Cohen) * ASTERISK-17138 - [patch] Asterisk not re-registering after it receives "Forbidden - wrong password on authentication" (Reported by Rudi) * ASTERISK-23011 - [patch]configure.ac and pbx_lua don't support lua 5.2 (Reported by George Joseph) * ASTERISK-22834 - Parking by blind transfer when lot full orphans channels (Reported by rsw686) * ASTERISK-23047 - Orphaned (stuck) channel occurs during a failed SIP transfer to parking space (Reported by Tommy Thompson) * ASTERISK-22946 - Local From tag regression with sipgate.de (Reported by Stephan Eisvogel) * ASTERISK-23010 - No BYE message sent when sip INVITE is received (Reported by Ryan Tilton) * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set - probably introduced in 11.7.0 (Reported by OK) Improvements made in this release: ----------------------------------- * ASTERISK-22728 - [patch] Improve Understanding Of 'Forcerport' When Running "sip show peers" (Reported by Michael L. Young) * ASTERISK-22659 - Make a new core and extra sounds release (Reported by Rusty Newton) * ASTERISK-22919 - core show channeltypes slicing (Reported by outtolunc) * ASTERISK-22918 - dahdi show channels slices PRI channel dnid on output (Reported by outtolunc) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.8.0 Thank you for your continued support of Asterisk!
2014-05-29Bump for perl-5.20.0.wiz1-2/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
2014-05-05Recursive revbump from x11/pixmanryoon1-2/+2
Fix PR pkg/48777
2014-04-09recursive bump from icu shlib major bump.obache1-2/+2
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-2/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2014-01-07Update to Asterisk 11.7.0: this is a minor bugfix updatejnemeth3-10/+12
The Asterisk Development Team has announced the release of Asterisk 11.7.0. The release of Asterisk 11.7.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release: * --- app_confbridge: Can now set the language used for announcements to the conference. * --- app_queue: Fix CLI "queue remove member" queue_log entry. * --- chan_sip: Do not increment the SDP version between 183 and 200 responses. * --- chan_sip: Allow a sip peer to accept both AVP and AVPF calls * --- chan_sip: Fix Realtime Peer Update Problem When Un-registering And Expires Header In 200ok For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.7.0 Thank you for your continued support of Asterisk!
2013-12-23Update to Asterisk 11.6.1: this is a security fix update to fixjnemeth8-67/+262
AST-2013-006 and AST-2013-007, and a minor bug fix update. pkgsrc change: disable SRTP on NetBSD as it doesn't link ---- 11.6.1 ---- The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.2, and Asterisk 1.8, 10, and 11. The available security releases are released as versions 1.8.15-cert4, 11.2-cert3, 1.8.24.1, 10.12.4, 10.12.4-digiumphones, and 11.6.1. The release of these versions resolve the following issues: * A buffer overflow when receiving odd length 16 bit messages in app_sms. An infinite loop could occur which would overwrite memory when a message is received into the unpacksms16() function and the length of the message is an odd number of bytes. * Prevent permissions escalation in the Asterisk Manager Interface. Asterisk now marks certain individual dialplan functions as 'dangerous', which will inhibit their execution from external sources. A 'dangerous' function is one which results in a privilege escalation. For example, if one were to read the channel variable SHELL(rm -rf /) Bad Things(TM) could happen; even if the external source has only read permissions. Execution from external sources may be enabled by setting 'live_dangerously' to 'yes' in the [options] section of asterisk.conf. Although doing so is not recommended. These issues and their resolutions are described in the security advisories. For more information about the details of these vulnerabilities, please read security advisories AST-2013-006 and AST-2013-007, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.6.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2013-006.pdf * http://downloads.asterisk.org/pub/security/AST-2013-007.pdf Thank you for your continued support of Asterisk! ----- 11.6.0 ----- The Asterisk Development Team has announced the release of Asterisk 11.6.0. The release of Asterisk 11.6.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release: * --- Confbridge: empty conference not being torn down (Closes issue ASTERISK-21859. Reported by Chris Gentle) * --- Let Queue wrap up time influence member availability (Closes issue ASTERISK-22189. Reported by Tony Lewis) * --- Fix a longstanding issue with MFC-R2 configuration that prevented users (Closes issue ASTERISK-21117. Reported by Rafael Angulo) * --- chan_iax2: Fix saving the wrong expiry time in astdb. (Closes issue ASTERISK-22504. Reported by Stefan Wachtler) * --- Fix segfault for certain invalid WebSocket input. (Closes issue ASTERISK-21825. Reported by Alfred Farrugia) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.6.0 Thank you for your continued support of Asterisk!
2013-10-19Revbump after updating textproc/icuadam1-2/+2
2013-10-10Recursive revbump from pango-1.36.0ryoon1-2/+2
2013-09-02Revbump after cairo updateadam1-1/+2
2013-08-30Update to Asterisk 11.5.1: this is a security fix release to fixjnemeth2-10/+9
AST-2013-004 and AST-2013-005. The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.2, and Asterisk 1.8, 10, and 11. The available security rele ases are released as versions 1.8.15-cert2, 11.2-cert2, 1.8.23.1, 10.12.3, 10.12.3-di giumphones, and 11.5.1. The release of these versions resolve the following issues: * A remotely exploitable crash vulnerability exists in the SIP channel driver if an ACK with SDP is received after the channel has been terminated. The handling code incorrectly assumes that the channel will always be present. * A remotely exploitable crash vulnerability exists in the SIP channel driver if an invalid SDP is sent in a SIP request that defines media descriptions before connection information. The handling code incorrectly attempts to reference the socket address information even though that information has not yet been set. These issues and their resolutions are described in the security advisories. For more information about the details of these vulnerabilities, please read security advisories AST-2013-004 and AST-2013-005, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.5.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2013-004.pdf * http://downloads.asterisk.org/pub/security/AST-2013-005.pdf Thank you for your continued support of Asterisk!
2013-08-08Add patches to convert RAII_VAR to a method that doesn't use nestedjnemeth14-8/+956
functions, thus making Asterisk portable to all C compilers. The patches from joerg@ (with one missing file added by myself).
2013-07-21Upgrade to Asterisk 11.5.0: this is a general bug fix releasejnemeth3-17/+23
pkgsrc changes: - add dependency on libuuid - work around NetBSD's incompatible implementation of IP_PKTINFO The Asterisk Development Team has announced the release of Asterisk 11.5.0. The release of Asterisk 11.5.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release: * --- Fix Segfault In app_queue When "persistentmembers" Is Enabled And Using Realtime * --- IAX2: fix race condition with nativebridge transfers. * --- Fix The Payload Being Set On CN Packets And Do Not Set Marker Bit * --- Fix One-Way Audio With auto_* NAT Settings When SIP Calls Initiated By PBX * --- chan_sip: NOTIFYs for BLF start queuing up and fail to be sent out after retries fail For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.5.0 Thank you for your continued support of Asterisk!
2013-07-12Bump PKGREVISION of all packages which create users, to pick up change ofjperkin1-2/+2
sysutils/user_* packages.
2013-06-16Asterisk is known to fail on 32-bit systems, specifically i386. Mark itjnemeth1-1/+4
as such until the bug is found and fixed.
2013-06-14- fix PLIST when jabber option is disabledjnemeth9-24/+189
- fix compile problem on newer NetBSD systems that have newlocale support - fix a couple of cases where ctype functions called with plain char - last two items from joerg@
2013-06-06Bump PKGREVISION for libXft changes for NetBSD native X support onwiz1-2/+2
NetBSD 6, requested by tron.
2013-06-04Try to fix the fallout caused by the fix for PR pkg/47882. Part 3:tron1-2/+2
Recursively bump package revisions again after the "freetype2" and "fontconfig" handling was fixed.
2013-06-03Bump freetype2 and fontconfig dependencies to current pkgsrc versions,wiz1-2/+2
to address issues with NetBSD-6(and earlier)'s fontconfig not being new enough for pango. While doing that, also bump freetype2 dependency to current pkgsrc version. Suggested by tron in PR 47882
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-15 19:17:51 +0000