mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-10-19 19:59:43 +00:00
Code Issues Releases Activity

Document new asterisk vulnerability.

Browse Source
This commit is contained in:
Guido Falsi 2017-12-23 09:55:08 +00:00
parent 6c0cd09b32
commit e9893af029
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=457035
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
security/vuxml/vuln.xml
View File

@ -58,6 +58,39 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
<topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For
those messages, if the header was not present and using
the PJSIP channel driver, it would cause Asterisk to
crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication
is enabled a user would have to first be authorized before
reaching the crash point.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
<cvename>CVE-2017-17850</cvename>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
<topic>MariaDB -- unspecified vulnerability</topic>
<affects>