CVS commit: [pkgsrc-2010Q4] pkgsrc/comms/asterisk18

["Matthias Scheler" <tron%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   tron
Date:           Tue Jan 25 15:28:55 UTC 2011

Modified Files:
        pkgsrc/comms/asterisk18 [pkgsrc-2010Q4]: Makefile distinfo
        pkgsrc/comms/asterisk18/patches [pkgsrc-2010Q4]: patch-aq

Log Message:
Pullup ticket #3336 - requested by gls
comms/asterisk18: security update

Revisions pulled up:
- comms/asterisk18/Makefile                     1.3-1.4
- comms/asterisk18/distinfo                     1.5-1.6
- comms/asterisk18/patches/patch-aq             1.2
---
Module Name:    pkgsrc
Committed By:   jnemeth
Date:           Sun Jan 16 17:52:43 UTC 2011

Modified Files:
        pkgsrc/comms/asterisk18: Makefile distinfo
        pkgsrc/comms/asterisk18/patches: patch-aq

Log Message:
Update to 1.8.2:

The release of Asterisk 1.8.2 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

* 'sip notify clear-mwi' needs terminating CRLF.
   (Closes issue #18275. Reported, patched by klaus3000)

* Patch for deadlock from ordering issue between channel/queue locks in
   app_queue (set_queue_variables).
   (Closes issue #18031. Reported by rain. Patched by bbryant)

* Fix cache of device state changes for multiple servers.
   (Closes issue #18284, #18280. Reported, tested by klaus3000. Patched,
tested
   by russellb)

* Resolve issue where channel redirect function (CLI or AMI) hangs up
the call
   instead of redirecting the call.
   (Closes issue #18171. Reported by: SantaFox)
   (Closes issue #18185. Reported by: kwemheuer)
   (Closes issue #18211. Reported by: zahir_koradia)
   (Closes issue #18230. Reported by: vmarrone)
   (Closes issue #18299. Reported by: mbrevda)
   (Closes issue #18322. Reported by: nerbos)

* Fix reloading of peer when a user is requested. Prevent peer reloading
from
   causing multiple MWI subscriptions to be created when using realtime.
   (Closes issue #18342. Reported, patched by nivek.)

* Fix XMPP PubSub-based distributed device state. Initialize pubsubflags
to 0
   so res_jabber doesn't think there is already an XMPP connection sending
   device state. Also clean up CLI commands a bit.
   (Closes issue #18272. Reported by klaus3000. Patched by Marquis42)

* Don't crash after Set(CDR(userfield)=...) in ast_bridge_call. Instead of
   setting peer->cdr = NULL, set it to not post.
   (Closes issue #18415. Reported by macbrody. Patched, tested by jsolares)

* Fixes issue with outbound google voice calls not working. Thanks to az1234
   and nevermind_quack for their input in helping debug the issue.
   (Closes issue #18412. Reported by nevermind_quack. Patched by dvossel)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.2
---
odule Name:     pkgsrc
Committed By:   jnemeth
Date:           Fri Jan 21 07:00:44 UTC 2011

Modified Files:
        pkgsrc/comms/asterisk18: Makefile distinfo

Log Message:
Update to 1.8.2.2

This is to fix AST-2011-001: Stack buffer overflow in SIP channel driver

               Asterisk Project Security Advisory - AST-2011-001

         Product        Asterisk
         Summary        Stack buffer overflow in SIP channel driver
    Nature of Advisory  Exploitable Stack Buffer Overflow
      Susceptibility    Remote Authenticated Sessions
         Severity       Moderate
      Exploits Known    No
       Reported On      January 11, 2011
       Reported By      Matthew Nicholson
        Posted On       January 18, 2011
     Last Updated On    January 18, 2011
     Advisory Contact   Matthew Nicholson <mnicholson at digium.com>
         CVE Name

   Description When forming an outgoing SIP request while in pedantic
mode, a
               stack buffer can be made to overflow if supplied with
               carefully crafted caller ID information. This vulnerability
               also affects the URIENCODE dialplan function and in some
               versions of asterisk, the AGI dialplan application as well..
               The ast_uri_encode function does not properly respect the
size
               of its output buffer and can write past the end of it when
               encoding URIs.

For full details, see:

http://downloads.digium.com/pub/security/AST-2011-001.html


To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.2.2.1 pkgsrc/comms/asterisk18/Makefile
cvs rdiff -u -r1.4 -r1.4.2.1 pkgsrc/comms/asterisk18/distinfo
cvs rdiff -u -r1.1.1.1 -r1.1.1.1.2.1 pkgsrc/comms/asterisk18/patches/patch-aq

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.