Fedora 18 Update: libktorrent-1.3.1-1.fc18
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-1045
2013-01-20 02:04:58
--------------------------------------------------------------------------------
Name : libktorrent
Product : Fedora 18
Version : 1.3.1
Release : 1.fc18
URL : http://ktorrent.org/
Summary : Library providing torrent downloading code
Description :
Library providing torrent downloading code.
--------------------------------------------------------------------------------
Update Information:
Changes in KTorrent 4.3.1:
- Fix new custom groups not appearing in add to group submenu (307230)
- Fix crash when right clicking on some locations in the GroupView due to 0 pointer (307160)
- Force KDirWatch to use polling when watching NFS filesystems (301381)
- Fix crash due to bus error in ip filter plugin (307854)
- First check for missing files then for unmounted storage (308638)
- Use extended selection mode in syndication plugin so ctrl key works as expected (308672)
- Fix crash in GroupViewModel when dragging torrents over groups (308733)
- Sort by total leechers and seeders, if connected seeders and leechers is equal (311470)
Changes in libktorrent-1.3.1:
- Add workaround for broken handling of btrfs subvolumes by solid (306825)
- Fix crash when preallocating diskspace when a file is enabled during the download of a torrent (307178)
- Make sure stats get updated properly during data check (308707)
- Bind peer sockets to preferred interface for outbound connections
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 15 2013 Alexey Kurov <nucleo(a)fedoraproject.org> - 1.3.1-1
- libktorrent-1.3.1
* Mon Dec 24 2012 Rex Dieter <rdieter(a)fedoraproject.org> 1.3.0-2
- backport some upstream fixes, and some .spec cleanup
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update libktorrent' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
Fedora 18 Update: ktorrent-4.3.1-1.fc18
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-1045
2013-01-20 02:04:58
--------------------------------------------------------------------------------
Name : ktorrent
Product : Fedora 18
Version : 4.3.1
Release : 1.fc18
URL : http://ktorrent.org/
Summary : A BitTorrent program
Description :
KTorrent is a BitTorrent program for KDE. Its main features are native KDE
integration, download of torrent files, upload speed capping, internet
searching using various search engines, UDP Trackers and UPnP support.
--------------------------------------------------------------------------------
Update Information:
Changes in KTorrent 4.3.1:
- Fix new custom groups not appearing in add to group submenu (307230)
- Fix crash when right clicking on some locations in the GroupView due to 0 pointer (307160)
- Force KDirWatch to use polling when watching NFS filesystems (301381)
- Fix crash due to bus error in ip filter plugin (307854)
- First check for missing files then for unmounted storage (308638)
- Use extended selection mode in syndication plugin so ctrl key works as expected (308672)
- Fix crash in GroupViewModel when dragging torrents over groups (308733)
- Sort by total leechers and seeders, if connected seeders and leechers is equal (311470)
Changes in libktorrent-1.3.1:
- Add workaround for broken handling of btrfs subvolumes by solid (306825)
- Fix crash when preallocating diskspace when a file is enabled during the download of a torrent (307178)
- Make sure stats get updated properly during data check (308707)
- Bind peer sockets to preferred interface for outbound connections
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 15 2013 Alexey Kurov <nucleo(a)fedoraproject.org> - 4.3.1-1
- ktorrent-4.3.1
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update ktorrent' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
[SECURITY] Fedora 17 Update: asterisk-10.12.0-1.fc17
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0994
2013-01-20 02:00:38
--------------------------------------------------------------------------------
Name : asterisk
Product : Fedora 17
Version : 10.12.0
Release : 1.fc17
URL : http://www.asterisk.org/
Summary : The Open Source PBX
Description :
Asterisk is a complete PBX in software. It runs on Linux and provides
all of the features you would expect from a PBX and more. Asterisk
does voice over IP in three protocols, and can interoperate with
almost all standards-based telephony equipment using relatively
inexpensive hardware.
--------------------------------------------------------------------------------
Update Information:
The Asterisk Development Team has announced the release of Asterisk 10.12.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 10.12.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following is a sample of the issues resolved in this release:
* --- app_meetme: Fix channels lingering when hung up under certain
conditions
(Closes issue ASTERISK-20486. Reported by Michael Cargile)
* --- Fix stuck DTMF when bridge is broken.
(Closes issue ASTERISK-20492. Reported by Jeremiah Gowdy)
* --- Improve Code Readability And Fix Setting natdetected Flag
(Closes issue ASTERISK-20724. Reported by Michael L. Young)
* --- Fix extension matching with the '-' char.
(Closes issue ASTERISK-19205. Reported by Philippe Lindheimer, Birger "WIMPy" Harzenetter)
* --- Fix call files when astspooldir is relative.
(Closes issue ASTERISK-20593. Reported by James Le Cuirot)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.12.0
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 18 2013 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.12.0-1:
- The Asterisk Development Team has announced the release of Asterisk 10.12.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.12.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- app_meetme: Fix channels lingering when hung up under certain
- conditions
- (Closes issue ASTERISK-20486. Reported by Michael Cargile)
-
- * --- Fix stuck DTMF when bridge is broken.
- (Closes issue ASTERISK-20492. Reported by Jeremiah Gowdy)
-
- * --- Improve Code Readability And Fix Setting natdetected Flag
- (Closes issue ASTERISK-20724. Reported by Michael L. Young)
-
- * --- Fix extension matching with the '-' char.
- (Closes issue ASTERISK-19205. Reported by Philippe Lindheimer, Birger "WIMPy" Harzenetter)
-
- * --- Fix call files when astspooldir is relative.
- (Closes issue ASTERISK-20593. Reported by James Le Cuirot)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.12.0
* Fri Jan 4 2013 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.11.1-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.11 and Asterisk 1.8, 10, and 11. The available security releases
- are released as versions 1.8.11-cert10, 1.8.19.1, 10.11.1, 10.11.1-digiumphones,
- and 11.1.1.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of these versions resolve the following two issues:
-
- * Stack overflows that occur in some portions of Asterisk that manage a TCP
- connection. In SIP, this is exploitable via a remote unauthenticated session;
- in XMPP and HTTP connections, this is exploitable via remote authenticated
- sessions.
-
- * A denial of service vulnerability through exploitation of the device state
- cache. Anonymous calls had the capability to create devices in Asterisk that
- would never be disposed of.
-
- These issues and their resolutions are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-014 and AST-2012-015, which were released at the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/C...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-014.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-015.pdf
* Fri Dec 14 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.11.0-1:
- The Asterisk Development Team has announced the release of Asterisk 10.11.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.11.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Prevent resetting of NATted realtime peer address on reload.
- (Closes issue ASTERISK-18203. Reported by daren ferreira)
-
- * --- Do not use a FILE handle when doing SIP TCP reads.
- (Closes issue ASTERISK-20212. Reported by Phil Ciccone)
-
- * --- Fix ConfBridge crash if no timing module loaded.
- (Closes issue ASTERISK-19448. Reported by feyfre)
-
- * --- confbridge: Fix a bug which made conferences not record with
- AMI/CLI commands
- (Closes issue ASTERISK-20601. Reported by Vilius)
-
- * --- Fix execution of 'i' extension due to uninitialized variable.
- (Closes issue ASTERISK-20455. Reported by Richard Miller)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.11.0
* Fri Dec 7 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.10.1-1
- The Asterisk Development Team has announced the release of Asterisk 10.10.1.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.10.1 resolves an issue reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is the issue resolved in this release:
-
- * --- chan_local: Fix local_pvt ref leak in local_devicestate().
- (Closes issue ASTERISK-20769. Reported by rmudgett)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.10.1
* Wed Nov 7 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.10.0-1:
- The Asterisk Development Team has announced the release of Asterisk 10.10.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.10.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Resolve issues in ConfBridge regarding marked, waitmarked, and
- unmarked users
- (Closes issue ASTERISK-19562. Reported by flan)
-
- * --- dsp.c User Configurable DTMF_HITS_TO_BEGIN and
- DTMF_MISSES_TO_END
- (Closes issue ASTERISK-17493. Reported by alecdavis)
-
- * --- Fix error where improper IMAP greetings would be deleted.
- (Closes issue ASTERISK-20435. Reported by fhackenberger)
-
- * --- iax2-provision: Fix improper return on failed cache retrieval
- (Closes issue ASTERISK-20337. Reported by John Covert)
-
- * --- Fix T.38 support when used with chan_local in between.
- (Closes issue ASTERISK-20229. Reported by wdoekes)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.10.0
* Tue Oct 9 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.9.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.9.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.9.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Fix channel reference leak in ChanSpy.
- (Closes issue ASTERISK-19461. Reported by Irontec)
-
- * --- dsp.c: Fix multiple issues when no-interdigit delay is present,
- and fast DTMF 50ms/50ms
- (Closes issue ASTERISK-19610. Reported by Jean-Philippe Lord)
-
- * --- Fix bug where final queue member would not be removed from
- memory.
- (Closes issue ASTERISK-19793. Reported by Marcus Haas)
-
- * --- Fix memory leak when CEL is successfully written to PostgreSQL
- database
- (Closes issue ASTERISK-19991. Reported by Etienne Lessard)
-
- * --- Fix DUNDi message routing bug when neighboring peer is
- unreachable
- (Closes issue ASTERISK-19309. Reported by Peter Racz)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.9.0
* Wed Sep 26 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.8.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.8.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.8.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- AST-2012-012: Resolve AMI User Unauthorized Shell Access through
- ExternalIVR
- (Closes issue ASTERISK-20132. Reported by Zubair Ashraf of IBM X-Force Research)
-
- * --- AST-2012-013: Resolve ACL rules being ignored during calls by
- some IAX2 peers
- (Closes issue ASTERISK-20186. Reported by Alan Frisch)
-
- * --- Handle extremely out of order RFC 2833 DTMF
- (Closes issue ASTERISK-18404. Reported by Stephane Chazelas)
-
- * --- Resolve severe memory leak in CEL logging modules.
- (Closes issue AST-916. Reported by Thomas Arimont)
-
- * --- Only re-create an SRTP session when needed
- (Issue ASTERISK-20194. Reported by Nicolo Mazzon)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.8.0
* Tue Sep 4 2012 Dan Horák <dan[at]danny.cz> - 10.7.1-2
- fix build on s390
* Thu Aug 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.7.1-1
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are
- released as versions 1.8.11-cert7, 1.8.15.1, 10.7.1, and 10.7.1-digiumphones.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of Asterisk 1.8.11-cert7, 1.8.15.1, 10.7.1, and 10.7.1-digiumphones
- resolve the following two issues:
-
- * A permission escalation vulnerability in Asterisk Manager Interface. This
- would potentially allow remote authenticated users the ability to execute
- commands on the system shell with the privileges of the user running the
- Asterisk application. Please note that the README-SERIOUSLY.bestpractices.txt
- file delivered with Asterisk has been updated due to this and other related
- vulnerabilities fixed in previous versions of Asterisk.
-
- * When an IAX2 call is made using the credentials of a peer defined in a
- dynamic Asterisk Realtime Architecture (ARA) backend, the ACL rules for that
- peer are not applied to the call attempt. This allows for a remote attacker
- who is aware of a peer's credentials to bypass the ACL rules set for that
- peer.
-
- These issues and their resolutions are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-012 and AST-2012-013, which were released at the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/C...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-012.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-013.pdf
* Thu Aug 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.7.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.7.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.7.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Fix deadlock potential with ast_set_hangupsource() calls.
- (Closes issue ASTERISK-19801. Reported by Alec Davis)
-
- * --- Fix request routing issue when outboundproxy is used.
- (Closes issue ASTERISK-20008. Reported by Marcus Hunger)
-
- * --- Set the Caller ID "tag" on peers even if remote party
- information is present.
- (Closes issue ASTERISK-19859. Reported by Thomas Arimont)
-
- * --- Fix NULL pointer segfault in ast_sockaddr_parse()
- (Closes issue ASTERISK-20006. Reported by Michael L. Young)
-
- * --- Do not perform install on existing directories
- (Closes issue ASTERISK-19492. Reported by Karl Fife)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.7.0
* Thu Aug 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.6.1-1
- The Asterisk Development Team has announced the release of Asterisk 10.6.1.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.6.1 resolves an issue reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is the issue resolved in this release:
-
- * --- Remove a superfluous and dangerous freeing of an SSL_CTX.
- (Closes issue ASTERISK-20074. Reported by Trevor Helmsley)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.6.1
* Thu Aug 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.6.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.6.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.6.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- format_mp3: Fix a possible crash in mp3_read().
- (Closes issue ASTERISK-19761. Reported by Chris Maciejewsk)
-
- * --- Fix local channel chains optimizing themselves out of a call.
- (Closes issue ASTERISK-16711. Reported by Alec Davis)
-
- * --- Re-add LastMsgsSent value for SIP peers
- (Closes issue ASTERISK-17866. Reported by Steve Davies)
-
- * --- Prevent sip_pvt refleak when an ast_channel outlasts its
- corresponding sip_pvt.
- (Closes issue ASTERISK-19425. Reported by David Cunningham)
-
- * --- Send more accurate identification information in dialog-info SIP
- NOTIFYs.
- (Closes issue ASTERISK-16735. Reported by Maciej Krajewski)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.6.0
* Wed Jul 18 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 10.5.2-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Mon Jul 9 2012 Petr Pisar <ppisar(a)redhat.com> - 10.5.2-1.1
- Perl 5.16 rebuild
* Thu Jul 5 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.5.2-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are
- released as versions 1.8.11-cert4, 1.8.13.1, 10.5.2, and 10.5.2-digiumphones.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of Asterisk 1.8.11-cert4, 1.8.13.1, 10.5.2, and 10.5.2-digiumphones
- resolve the following two issues:
-
- * If Asterisk sends a re-invite and an endpoint responds to the re-invite with
- a provisional response but never sends a final response, then the SIP dialog
- structure is never freed and the RTP ports for the call are never released. If
- an attacker has the ability to place a call, they could create a denial of
- service by using all available RTP ports.
-
- * If a single voicemail account is manipulated by two parties simultaneously,
- a condition can occur where memory is freed twice causing a crash.
-
- These issues and their resolution are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-010 and AST-2012-011, which were released at the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/C...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-010.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-011.pdf
* Thu Jun 28 2012 Petr Pisar <ppisar(a)redhat.com> - 10.5.1-1.1
- Perl 5.16 rebuild
* Fri Jun 15 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.5.1-1
- The Asterisk Development Team has announced a security release for Asterisk 10.
- This security release is released as version 10.5.1.
-
- The release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of Asterisk 10.5.1 resolves the following issue:
-
- * A remotely exploitable crash vulnerability was found in the Skinny (SCCP)
- Channel driver. When an SCCP client sends an Off Hook message, followed by
- a Key Pad Button Message, a structure that was previously set to NULL is
- dereferenced. This allows remote authenticated connections the ability to
- cause a crash in the server, denying services to legitimate users.
-
- This issue and its resolution is described in the security advisory.
-
- For more information about the details of this vulnerability, please read
- security advisory AST-2012-009, which was released at the same time as this
- announcement.
-
- For a full list of changes in the current releases, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisory is available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-009.pdf
* Fri Jun 15 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.5.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.5.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.5.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Turn off warning message when bind address is set to any.
- (Closes issue ASTERISK-19456. Reported by Michael L. Young)
-
- * --- Prevent overflow in calculation in ast_tvdiff_ms on 32-bit
- machines
- (Closes issue ASTERISK-19727. Reported by Ben Klang)
-
- * --- Make DAHDISendCallreroutingFacility wait 5 seconds for a reply
- before disconnecting the call.
- (Closes issue ASTERISK-19708. Reported by mehdi Shirazi)
-
- * --- Fix recalled party B feature flags for a failed DTMF atxfer.
- (Closes issue ASTERISK-19383. Reported by lgfsantos)
-
- * --- Fix DTMF atxfer running h exten after the wrong bridge ends.
- (Closes issue ASTERISK-19717. Reported by Mario)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.5.0
* Mon Jun 11 2012 Petr Pisar <ppisar(a)redhat.com> - 10.4.2-1.1
- Perl 5.16 rebuild
* Wed May 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.4.2-1
- The Asterisk Development Team has announced the release of Asterisk 10.4.2.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.4.2 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- * --- Resolve crash in subscribing for MWI notifications
- (Closes issue ASTERISK-19827. Reported by B. R)
-
- * --- Fix crash in ConfBridge when user announcement is played for
- more than 2 users
- (Closes issue ASTERISK-19899. Reported by Florian Gilcher)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.4.2
* Wed May 30 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.4.1-1
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are
- released as versions 1.8.11-cert2, 1.8.12.1, and 10.4.1.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of Asterisk 1.8.11-cert2, 1.8.12.1, and 10.4.1 resolve the following
- two issues:
-
- * A remotely exploitable crash vulnerability exists in the IAX2 channel
- driver if an established call is placed on hold without a suggested music
- class. Asterisk will attempt to use an invalid pointer to the music
- on hold class name, potentially causing a crash.
-
- * A remotely exploitable crash vulnerability was found in the Skinny (SCCP)
- Channel driver. When an SCCP client closes its connection to the server,
- a pointer in a structure is set to NULL. If the client was not in the
- on-hook state at the time the connection was closed, this pointer is later
- dereferenced. This allows remote authenticated connections the ability to
- cause a crash in the server, denying services to legitimate users.
-
- These issues and their resolution are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-007 and AST-2012-008, which were released at the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/C...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-007.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-008.pdf
* Fri May 4 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 10.4.0-1
- The Asterisk Development Team has announced the release of Asterisk 10.4.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.4.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- * --- Prevent chanspy from binding to zombie channels
- (Closes issue ASTERISK-19493. Reported by lvl)
-
- * --- Fix Dial m and r options and forked calls generating warnings
- for voice frames.
- (Closes issue ASTERISK-16901. Reported by Chris Gentle)
-
- * --- Remove ISDN hold restriction for non-bridged calls.
- (Closes issue ASTERISK-19388. Reported by Birger Harzenetter)
-
- * --- Fix copying of CDR(accountcode) to local channels.
- (Closes issue ASTERISK-19384. Reported by jamicque)
-
- * --- Ensure Asterisk acknowledges ACKs to 4xx on Replaces errors
- (Closes issue ASTERISK-19303. Reported by Jon Tsiros)
-
- * --- Eliminate double close of file descriptor in manager.c
- (Closes issue ASTERISK-18453. Reported by Jaco Kroon)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.4.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #891646 - CVE-2012-5976 asterisk: Crashes due to large stack allocations when using TCP (AST-2012-014)
https://bugzilla.redhat.com/show_bug.cgi?id=891646
[ 2 ] Bug #891649 - CVE-2012-5977 asterisk: Denial of service through exploitation of device state caching (AST-2012-015)
https://bugzilla.redhat.com/show_bug.cgi?id=891649
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update asterisk' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
Fedora 17 Update: warzone2100-3.1.0-1.fc17
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0878
2013-01-16 18:49:16
--------------------------------------------------------------------------------
Name : warzone2100
Product : Fedora 17
Version : 3.1.0
Release : 1.fc17
URL : http://wz2100.net/
Summary : Innovative 3D real-time strategy
Description :
Warzone 2100 was an innovative 3D real-time strategy game back in 1999, and
most will agree it didn't enjoy the commercial success it should have had. The
game's source code was liberated on December 6th, 2004, under a GPL license
(see COPYING in this directory for details). Soon after that, the Warzone 2100
ReDev project was formed to take care of its future.
--------------------------------------------------------------------------------
Update Information:
Update to 3.1.0
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 15 2013 Jan Synáček <jsynacek(a)redhat.com> - 3.1.0-1
- Update to 3.1.0
* Thu Dec 13 2012 Adam Jackson <ajax(a)redhat.com> - 3.1-0.11.rc3
- Rebuild for glew 1.9.0
* Wed Oct 17 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.10.rc3
- Update to rc3
* Mon Aug 27 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.9.rc2
- Update to rc2
- Improve spec again
* Tue Jul 31 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.7.beta11
- Rebuilt against new glew
- Make spec more fedora-review friendly
* Sun Jul 22 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 3.1-0.6.beta11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Wed Jun 20 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.5.beta11
- Update to 3.1 beta 11
* Wed May 9 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.4.beta9
- Update to 3.1 beta9
- Fix spec
* Wed Mar 21 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.0-0.3.beta7
- Fix sources
* Wed Mar 21 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.0-0.2.beta7
- Update to 3.1 beta7
* Thu Mar 15 2012 Jan Synáček <jsynacek(a)redhat.com> - 3.1-0.1.beta6
- Update to 3.1 beta6
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update warzone2100' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
[SECURITY] Fedora 18 Update: asterisk-11.2.0-1.fc18
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-1003
2013-01-20 02:01:38
--------------------------------------------------------------------------------
Name : asterisk
Product : Fedora 18
Version : 11.2.0
Release : 1.fc18
URL : http://www.asterisk.org/
Summary : The Open Source PBX
Description :
Asterisk is a complete PBX in software. It runs on Linux and provides
all of the features you would expect from a PBX and more. Asterisk
does voice over IP in three protocols, and can interoperate with
almost all standards-based telephony equipment using relatively
inexpensive hardware.
--------------------------------------------------------------------------------
Update Information:
The Asterisk Development Team has announced the release of Asterisk 11.2.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 11.2.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following is a sample of the issues resolved in this release:
* --- app_meetme: Fix channels lingering when hung up under certain
conditions
(Closes issue ASTERISK-20486. Reported by Michael Cargile)
* --- Fix stuck DTMF when bridge is broken.
(Closes issue ASTERISK-20492. Reported by Jeremiah Gowdy)
* --- Add missing support for "who hung up" to chan_motif.
(Closes issue ASTERISK-20671. Reported by Matt Jordan)
* --- Remove a fixed size limitation for producing SDP and change how
ICE support is disabled by default.
(Closes issue ASTERISK-20643. Reported by coopvr)
* --- Fix chan_sip websocket payload handling
(Closes issue ASTERISK-20745. Reported by Iñaki Baz Castillo)
* --- Fix pjproject compilation in certain circumstances
(Closes issue ASTERISK-20681. Reported by Dinesh Ramjuttun)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.2.0
The Asterisk Development Team has announced a security release for Asterisk 11,
Asterisk 11.1.2. This release addresses the security vulnerabilities reported in
AST-2012-014 and AST-2012-015, and replaces the previous version of Asterisk 11
released for these security vulnerabilities. The prior release left open a
vulnerability in res_xmpp that exists only in Asterisk 11; as such, other
versions of Asterisk were resolved correctly by the previous releases.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases
The release of these versions resolve the following two issues:
* Stack overflows that occur in some portions of Asterisk that manage a TCP
connection. In SIP, this is exploitable via a remote unauthenticated session;
in XMPP and HTTP connections, this is exploitable via remote authenticated
sessions. The vulnerabilities in SIP and HTTP were corrected in a prior
release of Asterisk; the vulnerability in XMPP is resolved in this release.
* A denial of service vulnerability through exploitation of the device state
cache. Anonymous calls had the capability to create devices in Asterisk that
would never be disposed of. Handling the cachability of device states
aggregated via XMPP is handled in this release.
These issues and their resolutions are described in the security advisories.
For more information about the details of these vulnerabilities, please read
security advisories AST-2012-014 and AST-2012-015.
For a full list of changes in the current release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
The security advisories are available at:
* http://downloads.asterisk.org/pub/security/AST-2012-014.pdf
* http://downloads.asterisk.org/pub/security/AST-2012-015.pdf
Thank you for your continued support of Asterisk - and we apologize for having
to do this twice!
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 18 2013 Jeffrey Ollie <jeff(a)ocjtech.us> - 11.2.0-1:
- The Asterisk Development Team has announced the release of Asterisk 11.2.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 11.2.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- app_meetme: Fix channels lingering when hung up under certain
- conditions
- (Closes issue ASTERISK-20486. Reported by Michael Cargile)
-
- * --- Fix stuck DTMF when bridge is broken.
- (Closes issue ASTERISK-20492. Reported by Jeremiah Gowdy)
-
- * --- Add missing support for "who hung up" to chan_motif.
- (Closes issue ASTERISK-20671. Reported by Matt Jordan)
-
- * --- Remove a fixed size limitation for producing SDP and change how
- ICE support is disabled by default.
- (Closes issue ASTERISK-20643. Reported by coopvr)
-
- * --- Fix chan_sip websocket payload handling
- (Closes issue ASTERISK-20745. Reported by Iñaki Baz Castillo)
-
- * --- Fix pjproject compilation in certain circumstances
- (Closes issue ASTERISK-20681. Reported by Dinesh Ramjuttun)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.2.0
* Thu Jan 3 2013 Jeffrey Ollie <jeff(a)ocjtech.us> - 11.1.2-1:
- The Asterisk Development Team has announced a security release for Asterisk 11,
- Asterisk 11.1.2. This release addresses the security vulnerabilities reported in
- AST-2012-014 and AST-2012-015, and replaces the previous version of Asterisk 11
- released for these security vulnerabilities. The prior release left open a
- vulnerability in res_xmpp that exists only in Asterisk 11; as such, other
- versions of Asterisk were resolved correctly by the previous releases.
-
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of these versions resolve the following two issues:
-
- * Stack overflows that occur in some portions of Asterisk that manage a TCP
- connection. In SIP, this is exploitable via a remote unauthenticated session;
- in XMPP and HTTP connections, this is exploitable via remote authenticated
- sessions. The vulnerabilities in SIP and HTTP were corrected in a prior
- release of Asterisk; the vulnerability in XMPP is resolved in this release.
-
- * A denial of service vulnerability through exploitation of the device state
- cache. Anonymous calls had the capability to create devices in Asterisk that
- would never be disposed of. Handling the cachability of device states
- aggregated via XMPP is handled in this release.
-
- These issues and their resolutions are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-014 and AST-2012-015.
-
- For a full list of changes in the current release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-014.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-015.pdf
-
- Thank you for your continued support of Asterisk - and we apologize for having
- to do this twice!
* Wed Jan 2 2013 Jeffrey Ollie <jeff(a)ocjtech.us> - 11.1.1-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.11 and Asterisk 1.8, 10, and 11. The available security releases
- are released as versions 1.8.11-cert10, 1.8.19.1, 10.11.1, 10.11.1-digiumphones,
- and 11.1.1.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of these versions resolve the following two issues:
-
- * Stack overflows that occur in some portions of Asterisk that manage a TCP
- connection. In SIP, this is exploitable via a remote unauthenticated session;
- in XMPP and HTTP connections, this is exploitable via remote authenticated
- sessions.
-
- * A denial of service vulnerability through exploitation of the device state
- cache. Anonymous calls had the capability to create devices in Asterisk that
- would never be disposed of.
-
- These issues and their resolutions are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2012-014 and AST-2012-015, which were released at the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/C...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1...
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2012-014.pdf
- * http://downloads.asterisk.org/pub/security/AST-2012-015.pdf
* Wed Dec 12 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 11.1.0-1:
- The Asterisk Development Team has announced the release of Asterisk 11.1.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 11.1.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is a sample of the issues resolved in this release:
-
- * --- Fix execution of 'i' extension due to uninitialized variable.
- (Closes issue ASTERISK-20455. Reported by Richard Miller)
-
- * --- Prevent resetting of NATted realtime peer address on reload.
- (Closes issue ASTERISK-18203. Reported by daren ferreira)
-
- * --- Fix ConfBridge crash if no timing module loaded.
- (Closes issue ASTERISK-19448. Reported by feyfre)
-
- * --- Fix the Park 'r' option when a channel parks itself.
- (Closes issue ASTERISK-19382. Reported by James Stocks)
-
- * --- Fix an issue where outgoing calls would fail to establish audio
- due to ICE negotiation failures.
- (Closes issue ASTERISK-20554. Reported by mmichelson)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.1.0
* Fri Dec 7 2012 Jeffrey Ollie <jeff(a)ocjtech.us> - 11.0.2-1:
- The Asterisk Development Team has announced the release of Asterisk 11.0.2.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 11.0.2 resolves an issue reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following is the issue resolved in this release:
-
- * --- chan_local: Fix local_pvt ref leak in local_devicestate().
- (Closes issue ASTERISK-20769. Reported by rmudgett)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.0.2
* Wed Dec 5 2012 Dan Horák <dan[at]danny.cz> - 11.0.1-3
- simplify LDFLAGS setting
* Fri Nov 30 2012 Dennis Gilmore <dennis(a)ausil.us> - 11.0.1-2
- clean up things to allow building on arm arches
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #891646 - CVE-2012-5976 asterisk: Crashes due to large stack allocations when using TCP (AST-2012-014)
https://bugzilla.redhat.com/show_bug.cgi?id=891646
[ 2 ] Bug #891649 - CVE-2012-5977 asterisk: Denial of service through exploitation of device state caching (AST-2012-015)
https://bugzilla.redhat.com/show_bug.cgi?id=891649
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update asterisk' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
[SECURITY] Fedora 16 Update: proftpd-1.3.4b-5.fc16
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0468
2013-01-09 08:16:42
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 16
Version : 1.3.4b
Release : 5.fc16
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to mod_sftp and the handling of the MKDIR SFTP request as well.
Note that using the DefaultRoot directive to restrict sessions mitigates this attack, since the symlinks created by the local attacker will point outside of the chroot(2) area within the FTP session, and thus the ownership change will fail. The default configuration in Fedora applies the DefaultRoot directive to all users except "adm".
The upstream reference for this issue is:
http://bugs.proftpd.org/show_bug.cgi?id=3841
This update includes upstream's backport to proftpd 1.3.4 of the fix for this issue.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 16 2013 Paul Howarth <paul(a)city-fan.org> 1.3.4b-5
- Update patch for CVE-2012-6095 to cover vroot cases
* Mon Jan 7 2013 Paul Howarth <paul(a)city-fan.org> 1.3.4b-4
- Fix possible symlink race when applying UserOwner to newly created directory
(CVE-2012-6095, #892715, http://bugs.proftpd.org/show_bug.cgi?id=3841)
* Sat Sep 22 2012 Remi Collet <remi(a)fedoraproject.org> 1.3.4b-3
- Rebuild against libmemcached.so.11 without SASL
* Thu Aug 30 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4b-2
- Add support for systemd presets in Fedora 18+ (#850281)
* Wed Aug 1 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4b-1
- Update to 1.3.4b
- Fixed mod_ldap segfault on login when LDAPUsers with no filters used
- Fixed sporadic SFTP upload issues for large files
- Fixed SSH2 handling for some clients (e.g. OpenVMS)
- New FactsOptions directive; see doc/modules/mod_facts.html#FactsOptions
- Fixed build errors on Tru64, AIX, Cygwin
- Lots of bugs fixed - see NEWS for details
- No bzipped tarball release this time, so revert to gzipped one
- Drop patches for fixes included in upstream release
* Sat Jul 21 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> 1.3.4a-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Tue Jul 3 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-10
- Move tmpfiles.d file from %{_sysconfdir} to %{_prefix}/lib
* Sat Apr 21 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-9
- Rebuild for new libmemcached in Rawhide
* Fri Apr 13 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-8
- Do hardened (PIE) builds where possible
- Drop %defattr, redundant since rpm 4.4
- Always look for TLS certs in /etc/pki/tls/certs
* Mon Mar 12 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-7
- Tweak logrotate script for systemd compatibility (#802178)
- Fix leaked file descriptors for log files (as per bug 3751)
* Sat Mar 3 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-6
- Rebuild for new libmemcached in Rawhide
* Tue Feb 28 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-5
- Document SELinux configuration for ProFTPD in proftpd.conf (#785443)
- Add support for basic and administrative controls actions using ftpdctl by
default (#786623)
- Add trace logging directives in proftpd.conf but disable them by default as
they impair performance
- Fix ftpwho/ftptop not showing command arguments (bug 3714)
- Fix MLSD/MLST fail with "DirFakeUser off" or "DirFakeGroup off" (bug 3715)
- Fix proftpd fails to run with "Abort trap" error message (bug 3717)
- Fix LIST -R can loop endlessly if bad directory symlink exists (bug 3719)
- Fix overly restrictive module logfile permissions (bug 3720)
- Fix mod_memcache segfault on server restart (bug 3723)
- Fix unloading mod_quotatab causes segfault (#757311, bug 3724)
- Fix mod_exec does not always capture stdout/stderr output from executed
command (bug 3726)
- Fix mod_wrap2 causes unexpected LogFormat %u expansion for SFTP connections
(bug 3727)
- Fix mod_ldap segfault when LDAPUsers is used with no optional filters
(bug 3729)
- Fix DirFakeUser/DirFakeGroup off with name causes SIGSEGV for MLSD/MLST
commands (bug 3734)
- Fix improper handling of self-signed certificate in client-sent cert list
when "TLSVerifyClient on" is used (bug 3742)
- Fix random stalls/segfaults seen when transferring large files via SFTP
(bug 3743)
- Support ls(1) -1 option for LIST command (bug 3744)
- Reject PASV command if no IPv4 address available (bug 3745)
- Support applying ListOptions only to NLST or to LIST commands (bug 3746)
- Support option for displaying symlinks via MLSD using syntax preferred by
FileZilla (bug 3747)
- Fix mod_ban not closing and reopening the BanLog/BanTable file descriptors
on restart, causing a file descriptor leak (bug 3751)
- Fix mod_ctrls no longer listening on ControlsSocket after restart (bug 3756)
* Thu Feb 9 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-4
- Rebuild for new libpcre in Rawhide
* Mon Jan 16 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-3
- Add -utils subpackage for support tools, which means the main package
no longer requires perl
* Tue Jan 10 2012 Paul Howarth <paul(a)city-fan.org> 1.3.4a-2
- Make mod_vroot a DSO, loaded by default (#772354)
- VRootAlias for /etc/security/pam_env.conf is redundant, so remove it
- Add BanMessage (#772354)
- Add -devel subpackage for building third-party modules
* Fri Nov 11 2011 Paul Howarth <paul(a)city-fan.org> 1.3.4a-1
- Update to 1.3.4a:
- Fixed mod_load/mod_wrap2 build issues
- Drop now-redundant workaround for building mod_load and mod_wrap2
- Drop upstreamed patch for xinetd config typo
* Thu Nov 10 2011 Paul Howarth <paul(a)city-fan.org> 1.3.4-1
- Update to 1.3.4, addressing the following bugs since 1.3.4rc3:
- ProFTPD with mod_sql_mysql dies of "Alarm clock" on FreeBSD (bug 3702)
- mod_sql_mysql.so: undefined symbol: make_scrambled_password with MySQL 5.5
on Fedora (bug 3669)
- PQescapeStringConn() needs a better check (bug 3192)
- Enable OpenSSL countermeasure against SSLv3/TLSv1 BEAST attacks (bug 3704);
to disable this countermeasure, which may cause interoperability issues
with some clients, use the NoEmptyFragments TLSOption
- Support SFTPOption for ignoring requests to modify timestamps (bug 3706)
- RPM build on CentOS 5.5 (64bit): "File not found by glob" (bug 3640)
- Response pool use-after-free memory corruption error
(bug 3711, #752812, ZDI-CAN-1420, CVE-2011-4130)
- Drop upstream patch for make_scrambled_password_323
- Use upstream SysV initscript rather than our own
- Use upstream systemd service file rather than our own
- Use upstream PAM configuration rather than our own
- Use upstream logrotate configuration rather than our own
- Use upstream tempfiles configuration rather than our own
- Use upstream xinetd configuration rather than our own
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #892715 - CVE-2012-6095 proftpd: Symlink race condition when applying UserOwner to a newly (ProFTPD) created directory
https://bugzilla.redhat.com/show_bug.cgi?id=892715
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
[SECURITY] Fedora 18 Update: proftpd-1.3.4b-5.fc18
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0437
2013-01-08 20:08:55
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 18
Version : 1.3.4b
Release : 5.fc18
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to mod_sftp and the handling of the MKDIR SFTP request as well.
Note that using the DefaultRoot directive to restrict sessions mitigates this attack, since the symlinks created by the local attacker will point outside of the chroot(2) area within the FTP session, and thus the ownership change will fail. The default configuration in Fedora applies the DefaultRoot directive to all users except "adm".
The upstream reference for this issue is:
http://bugs.proftpd.org/show_bug.cgi?id=3841
This update includes upstream's backport to proftpd 1.3.4 of the fix for this issue.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 16 2013 Paul Howarth <paul(a)city-fan.org> 1.3.4b-5
- Update patch for CVE-2012-6095 to cover vroot cases
* Mon Jan 7 2013 Paul Howarth <paul(a)city-fan.org> 1.3.4b-4
- Fix possible symlink race when applying UserOwner to newly created directory
(CVE-2012-6095, #892715, http://bugs.proftpd.org/show_bug.cgi?id=3841)
* Sat Sep 22 2012 Remi Collet <remi(a)fedoraproject.org> 1.3.4b-3
- Rebuild against libmemcached.so.11 without SASL
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #892715 - CVE-2012-6095 proftpd: Symlink race condition when applying UserOwner to a newly (ProFTPD) created directory
https://bugzilla.redhat.com/show_bug.cgi?id=892715
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
Fedora 18 Update: samba-4.0.1-1.fc18
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0972
2013-01-18 19:36:06
--------------------------------------------------------------------------------
Name : samba
Product : Fedora 18
Version : 4.0.1
Release : 1.fc18
URL : http://www.samba.org/
Summary : Server and Client software to interoperate with Windows machines
Description :
Samba is the standard Windows interoperability suite of programs for Linux and Unix.
--------------------------------------------------------------------------------
Update Information:
Update to Samba 4.0.1.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 16 2013 - Andreas Schneider <asn(a)redhat.com> - 2:4.0.1-1
- Update to Samba 4.0.1.
- Fixes CVE-2013-0172.
* Mon Dec 17 2012 - Andreas Schneider <asn(a)redhat.com> - 2:4.0.0-174
- Fix typo in winbind-krb-locator post uninstall script.
* Tue Dec 11 2012 - Andreas Schneider <asn(a)redhat.com> - 2:4.0.0-173
- Update to Samba 4.0.0.
* Thu Dec 6 2012 - Andreas Schneider <asn(a)redhat.com> - 2:4.0.0-171.rc6
- Fix typo in winbind-krb-locator post uninstall script.
* Tue Dec 4 2012 - Andreas Schneider <asn(a)redhat.com> - 2:4.0.0-170.rc6
- Update to Samba 4.0.0rc6.
- Add /etc/pam.d/samba for swat to work correctly.
- resolves #882700
* Fri Nov 23 2012 Guenther Deschner <gdeschner(a)redhat.com> - 2:4.0.0-169.rc5
- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update samba' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months
Fedora 17 Update: non-daw-1.1.0-0.1.gitae6b78cf.fc17
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0798
2013-01-15 01:43:17
--------------------------------------------------------------------------------
Name : non-daw
Product : Fedora 17
Version : 1.1.0
Release : 0.1.gitae6b78cf.fc17
URL : http://non-daw.tuxfamily.org/
Summary : A digital audio workstation for JACK
Description :
Non-daw is a digital audio workstation for JACK
--------------------------------------------------------------------------------
Update Information:
Non-daw is a digital audio workstation for JACK
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #866012 - Review Request: non-daw - a digital audio workstation using JACK
https://bugzilla.redhat.com/show_bug.cgi?id=866012
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update non-daw' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
11 years, 3 months